Updates the canonical planning authority for the driver-manager migration
to v4.3, which closes the last open v4.0 P3 item ('Driver-level
Driver::on_error IPC') via a three-layer architecture:
1. Manager-side trait: DriverConfig::on_error override returns the
severity mapping by default; consultable from the AER dispatch.
2. Sidecar IPC (manager): UnixStream::pair(), child fd as
REDBEAR_DRIVER_ERROR_FD env var, parent fd registered by BDF,
200ms timeout on the IPC roundtrip, fall-back chain (IPC -> in-
process -> severity default).
3. Sidecar IPC (driver): linux-kpi pci_register_error_handler() +
worker thread that services the sidecar fd.
Documents the wire protocol, the C-side API contract, the
discriminant mappings, and the explicit decision to keep wire types
duplicated between driver-manager and linux-kpi rather than extract
a shared crate.
Status table: Open items now empty of v4.0 P3 list items. Remaining
operator-only gates (hardware validation matrix, two-week soak) are
noted but are out of scope for code work. Driver-level Driver::on_error
adoption by shipped drivers is now possible (the IPC layer is ready)
but no daemon opts in yet -- that is an integration task for future
driver work.
Last reviewed line updated to 2026-07-24 (v4.3).
Entire greeter-critical stack (Qt 6.11.1 + mesa + 9 kf6 core + sddm +
redbear-compositor + redbear-greeter) compiles. Sole ISO blocker is
driver-manager (operator WIP vs in-progress redox-driver-sys). Documents the
GREETER-DEFER re-enable path for the full Plasma desktop.
Comprehensive 3D userland plan based on direct code audit of the
Mesa 26.1.4 build, redox-drm Intel backend, virgl runtime path,
amdgpu C port, and libdrm enablement. Seven critical gaps identified
that block all hardware-accelerated 3D rendering on Red Bear OS
beyond llvmpipe fallback:
1. Mesa gallium-drivers=softpipe,llvmpipe,virgl — NO iris, NO crocus,
NO radeonsi. The README/CHANGELOG claim that 'all 6 Red Bear
Mesa patches are wired' is incorrect: only 5 are wired; patches
03 and 06 are orphans because patch 03 targets
src/egl/drivers/dri2/platform_redox.c which does not exist in
Mesa 26.1.4 upstream (the file was removed). Patches 03/06
cannot be cleanly reapplied — they need re-creation against
the current Mesa API.
2. No 'redox' EGL platform in Mesa 26.1.4. EGL_PLATFORM=wayland
resolves to swrast (llvmpipe) on Redox. virgl and iris are
never auto-selected.
3. No Mesa winsys for Redox (src/gallium/winsys/redox/ does not
exist). The virgl driver uses upstream's generic
virgl_drm_winsys which depends on libdrm's redox.patch to
redirect ioctls to scheme:drm.
4. Intel kernel backend supports only Gen9–Gen14 (Meteor Lake).
No Lunar Lake (Xe2, Gen15) device IDs. No Panther Lake (Xe3,
Gen16) device IDs. The display version table stops at 14.
5. No Vulkan built (vulkan-drivers= empty). No anv (Intel), no
radv (AMD), no venus (virtio-gpu Vulkan).
6. The redox_private_cs_submit ABI exists in redox-drm (real
implementation for Intel ring submission with seqno tracking,
space-wait, MI_FLUSH_DW) but no Mesa gallium driver consumes it.
7. The amdgpu C port is display-only (DC modeset, no render/3D).
It does NOT provide a Mesa radeonsi winsys. Stages 2-4 of the
amdgpu recipe are intentionally empty (no Linux TTM/core
source).
The plan file (786 lines) covers:
- Verified code state from direct read (Mesa recipe, Intel
backend, virgl, amdgpu, libdrm)
- Reality-vs-claim corrections (6 overclaims in current docs)
- Hardware-acceleration status table (10 paths)
- 7-phase execution plan with explicit acceptance criteria
for each phase:
Phase 1: Validate current virgl runtime path (1-2 weeks)
Phase 2: Add Lunar Lake and Panther Lake device IDs
Phase 3: Restore the Redox EGL platform (re-create)
Phase 4: Add Intel iris (Gen8-Gen14) — biggest piece, 8-12 weeks
Phase 5: Add AMD radeonsi — 6-8 weeks
Phase 6: Vulkan (enables anv/radv) — 2-4 weeks
Phase 7: Panther Lake kernel driver — 12-16 weeks
- Validation matrix per vendor
- File-level change catalog
- Risk register
- Operating rule: 'code presence is not support; build success
is not support; llvmpipe is not acceleration; an env-override
that requires manual setup is not a runtime path'.
Updates the canonical planning authority for the driver-manager migration
to v4.2, which closes:
* 'acpid pci_fd is not registered' (ACPI session) — was the last
open P3 item from v4.0. Fixed in commit b906ad68 / submodule bump
4db58bd1e0.
* Per-vendor firmware packaging — split redbear-firmware into four
per-vendor recipes (redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth}).
Also captures the v4.2 self-review followups:
* UnifiedEvent::Aer threads the RecoveryAction through, so the
callback no longer recomputes route_to_driver per event.
* iommu/numad scheme paths corrected: iommu was checking a
hash-keyed path the daemon does not expose, numa was checking
/scheme/numad/device/<bdf> when the numad daemon actually writes
to /scheme/proc/numa.
* RecoveryAction::Fatal now emits an ERROR-level operator-tooling
marker (AER-FATAL: ...) instead of being silently dropped.
Status table: AER row + Quirks row reflect v4.2 state. Adjacent-
technology matrix unchanged: cpufreq/thermald remain compatible,
iommu/numad now honest via scheme-presence detection.
Last reviewed line updated to 2026-07-24 (v4.2).
Self-review found the v4.1 update's AER row claimed 'Driver::on_error
→ RecoveryAction on bound devices is now end-to-end rather than
discarded.' That is misleading: DriverConfig does not override
Driver::on_error (the trait method keeps its default Ok(Handled)
impl), so the trait callback is never invoked. The v4.1 fix wires
manager-level auto-dispatch (AER event → route_to_driver →
dispatch_recovery), not driver-level on_error IPC. The driver-IPC
item remains open.
Reword the row to say manager-level dispatch and note that
Driver::on_error IPC is a separate item.
Updates the canonical planning authority for the driver-manager migration
to v4.1, which closes the three P3 items v4.0 had declared open.
Adds:
* v4.1 update block with the table mapping each v4.0 P3 item to its
v4.1 resolution (QuirkPhase::Early gating, AER auto-dispatch,
per-vendor firmware assessment) and the IOMMU/NUMA honest-absence
fix in redox-driver-core::modern_technology.
* Driver-by-driver audit summary — every PCI driver invoked from
/lib/drivers.d/*.toml plus the modern-tech daemons and bridging
consumers. No stubs, no todo!()/unimplemented!() in production
paths.
* Adjacent-technology compatibility matrix — cpufreqd/thermald
verified compatible; iommu now honest; udev-shim/driver-params
wired correctly; redox-drm/xhcid/iwlwifi/amdgpu use the granted
channel contract.
Refreshes the v4.0 post-cutover table to reflect the v4.1 AER row
('auto-dispatch from listener; RecoveryAction::ResetDevice/RescanBus
execute via shared dispatch_recovery helper') and the v4.1 quirks
row (phase = early/enable consulted at probe time).
Replaces the now-stale v4.0 'Open items (updated)' line with the v4.1
list — none from v4.0 P3, plus the operator-only gates that remain
(ACPI session, hardware validation matrix, two-week soak).
Updates Last reviewed line to 2026-07-24.
Add a "Canonical build — do NOT bypass" subsection to AGENTS.md and
local/AGENTS.md, and inline warnings above every instructional repo cook /
repo fetch / make live / make r.<recipe> mention across the build/patch/plan
docs. Rationale (learned the hard way this session): direct repo cook/fetch
skips apply-patches.sh patch-linking + staleness handling, causing broken
patches (qtsvg CVE) and wasted rebuilds. Always build via
local/scripts/build-redbear.sh.
redbear-info's integration check list still labeled the PCI spawner as
'pcid-spawner' and pointed at /usr/bin/pcid-spawner (deleted). Updated
to 'driver-manager' with /usr/bin/driver-manager and a note about
/scheme/driver-manager/bound. Plan v3.2 marks P2-1 done (pcid AER +
pciehp producers validated in QEMU).
SDDM greeter renders on redbear-compositor (per /etc/sddm.conf CompositorCommand);
KWin is the post-login session compositor. Runtime chain (driver-manager →
redox-drm → card0 → sddm → redbear-compositor → greeter) is coherent, BUT three
display entry points (20_display redbear-session-launch, 20_greeter
redbear-greeterd, 21_sddm) all fire oneshot_async and would contend for the
single-owner GPU/card0. For a clean SDDM path the first two must be disabled
(operator sign-off required).
Phase status for making redbear-full compile + run to the SDDM Wayland greeter:
build-system llvm fix, Mesa EGL gate persisted, VirGL priority (all done);
Rust components (redox-drm, redbear-compositor) compile-verified; remaining =
full C/C++ cook campaign (mesa/qt6/kf6/kwin/sddm) + Qt6 null+8 runtime validation
+ boot. Records upstream cherry-pick candidates and component homes.
Record the two concrete prerequisites for compositor input wiring, found by
reading the compositor source: (1) an event-loop restructure — it uses a
blocking accept loop, drains keys only reactively, and ClientState stores no
UnixStream, so no input source can push wl_keyboard to a client; (2) the
desktop cannot run without DRM/Mesa (no /scheme/drm/card0 on mini), so the
wiring is unvalidatable until the Mesa EGL/DRI port lands. Defines the exact
wiring for when those clear (read /scheme/evdev, set_vt_mode, real XKB keymap
fd, keycode = evdev - 8).
P0 green (acpid compiles). Fresh redbear-mini boot confirms: no console
regression (login + shell command execution intact) and the raw tap is live
(evdevd reads consumer_raw, evdev scheme functional). Boot-log errors observed
are pre-existing and unrelated to the input stack.
Record what landed (S1 raw evdev tap, S4-core VT graphics-mode op, S5 seatd
local package; all compile-checked, boot-validation P0-gated) and correct the
Defect-3 framing: fbcond is a byte-queue + CR/LF + special-key escapes, not a
second canonical line discipline (ptyd is the only one), and the console login
works — so the old "collapse two disciplines" console surgery is deferred as
unnecessary and risky. Grab arbitration + compositor wiring remain gated on the
Mesa desktop bring-up.
Cross-referenced the console-input path against Linux/CachyOS
(local/reference/linux-7.1/drivers/{input,tty}/). Linux applies the
keymap once (vt/keyboard.c) and runs one line discipline (n_tty.c)
shared by the console tty and ptys; RedBear duplicates the keymap
(inputd + fbcond) and CR/LF (fbcond + ptyd) and runs two disciplines
bridged by getty — which is where typed characters are lost (echoed but
not executed). Plan: inputd owns the keymap and emits the full byte
stream (incl. escape sequences); fbcond becomes display-only passthrough
(no keymap, no CR/LF, no cooking); ptyd is the sole line discipline.
Staged, each stage independently bootable; validation needs the build
green (acpi-rs currently blocks it).
- AGENTS.md + docs/README.md: pcid-spawner is retired and removed
(2026-07-24); driver-manager owns the path unconditionally; services
list and networking description updated.
- Migration plan v3.1 section: fallback framing replaced with the full
retirement (crate, service files, build wiring removed; source in git
history).
- Assessment: pcid-spawner row updated to retired; the never-delete
constraint noted as superseded by the operator's retirement decision.
Redesign grounded in the Linux 7.1 quirk-consumption cross-reference
(9 families, one three-layer invariant: match -> store -> consume):
- New open domain channel: [[<domain>_quirk]] TOML tables matched by
(vendor, device) with wildcards, accumulated as string flags by
quirks::lookup_driver_quirks(domain, vid, did). The table name IS the
domain key — new driver domains need zero registry code (Linux Type-C
model: driver-owned fixup tables like HDA's per-codec lists).
- lookup_audio_quirks(vid, did) as the first domain convenience API for
ihdad's future integration.
- quirks.d/15-audio.toml converted from [[pci_quirk]] to [[audio_quirk]]
— the audio_* flags (force_eapd, single_cmd, position_fix_lpib,
mirroring Linux sound/pci/hda) are now carried as data instead of
warned-and-dropped on every probe cycle.
- Docs: three-layer model in QUIRKS-SYSTEM.md + consumption contract
(bind-time / core-runtime / driver-runtime); QUIRKS-IMPROVEMENT-PLAN.md
v2.0 with the redesign assessment and cutover-era reality (stale
pcid-spawner broker references removed).
- 75/75 redox-driver-sys tests pass (new domain loader test).
- Plan v3.2: runtime gate PASSED (initfs ahcid bind, switchroot, rootfs
e1000d concurrent bind with zero deferred, scheme live, resident
hotplug loop); the four runtime-only bugs it found and their fixes;
cookbook cargo-path-dep staleness fix verified.
- Assessment § 12: gate evidence table + runtime-only bug register.
- PACKAGE-BUILD-QUIRKS.md: new platform quirk — std::thread::scope
hangs on the Redox target (park/unpark unvalidated); spawn+join is
the required pattern; RwLock::write and park/scope remain unvalidated.
- Pointers bumped to v3.2.
Record that redbear-mini now boots to the Red Bear login: prompt in QEMU.
Document the root cause (dw_i2c::endpoint::serve register_sync_scheme
never returned the cap fd to init — ptyd-class deadlock on type={scheme}
services) and the fix (deliver cap fd via INIT_NOTIFY). Note follow-ups:
_REG opregion-connect is dead code (initialize_namespace never called),
and driver-manager maps class=0x03 to full-only redox-drm in mini.
Plan v3.1 records the completed P0/LDR/P2 work program and the
operator-ratified cutover (driver-manager owns the boot path in all
redbear-* configs; pcid-spawner gated as fallback). Assessment § 11
documents the OS-services integration: init ConditionPathExists gate,
live driver-params bridge, udev-shim driver-binding gap (P3), and the
correct absence of D-Bus (bridge-on-demand pattern).
- redox-driver-core: DeviceManager stores drivers as Arc<dyn Driver>;
ConcurrentDeviceManager jobs carry priority-ordered candidate lists
(static match + dynids); workers invoke the real Driver::probe() with
serial-equivalent per-device semantics. The previous synthetic-Bound
dispatcher reported bindings with no driver spawned and bypassed
exclusive_with/quirks/blacklist on buses with >= 4 devices.
- scheme.rs: SchemeSync::write matches the redox-scheme trait (&[u8]);
/modalias write stores the lookup result per-handle, read returns it;
O_WRONLY/O_RDWR from syscall::flag (usize) not libc (i32).
- config.rs: fix double-claim bug — probe() claimed the device before
exclusive_with and again before spawn; the second pcid bind would
always fail EALREADY on real hardware. One claim threaded to spawn.
- main.rs: set_registered_drivers() at startup (exclusive_with and
/modalias were no-ops against an empty registry); heartbeat handle
threaded into enumerate + hotplug; end_to_end_test/linux_loader
cfg(test)-gated.
- reaper.rs/sighup.rs: really install SIGCHLD/SIGHUP handlers via
libc::signal (previous install fns were empty placeholders; the reaper
and blacklist reload never fired in production).
- unified_events.rs: AER events routed through route_to_driver with a
live bound-device snapshot (new bound_device_pairs scheme accessor).
- Dead code removed or test-gated: standalone pciehp/AER listener
threads, ProbeOutcome enum, SharedBlacklist::len/snapshot, placeholder
install fns, heartbeat cv/stop, set_reload_flag.
- 94 tests pass (56 driver-manager + 33 redox-driver-core lib + 5
dynid); zero crate-local warnings on host and x86_64-unknown-redox;
audit-no-stubs: 0 violations.
Eighth-round integrations of the driver-manager migration's D-phase.
This round closes the remaining gaps from the v1.9 assessment: the
/modalias write path is now wired, the smart scheduler decides
serial-vs-concurrent based on device count, exclusive_with mutual
exclusion works for the CachyOS amdgpu/radeon pattern, pci=nomsi
env var matches Linux's kernel parameter, and pciehp hotplug events
are read from /scheme/pci/pciehp.
scheme.rs:
- Added /modalias write path. Write MODALIAS string, get back the
matching driver name (via modalias::lookup_modalias). The endpoint
is now a real read/write interface, not a static hint.
modalias.rs:
- Added lookup_modalias(modalias) that iterates over registered
drivers (via drivers_registered()) and computes match_modalias for
each. Returns the driver's name if a match is found.
config.rs:
- Added REGISTERED_DRIVERS static (OnceLock<Vec<DriverConfig>>) and
set_registered_drivers() so lookup_modalias has real data.
- Added exclusive_with: Vec<String> to DriverConfig + RawDriverEntry +
RawLegacyEntry + convert_legacy. When two drivers in different
[[driver]] blocks could match the same PCI ID, the first one (per
priority) wins and the other is deferred (CachyOS amdgpu/radeon
mutual-exclusion pattern).
- Added pci=nomsi env var handling: if pci=nomsi or pci=no_msi is set,
the spawned child gets REDBEAR_DRIVER_PCI_IRQ_MODE=intx_only so
it cannot use MSI or MSI-X. Matches Linux's pci=nomsi kernel parameter.
main.rs:
- Declared pciehp module. Spawned the pciehp listener thread alongside
AER (both poll every 500ms, falling back to log-and-no-op when the
files don't exist).
pciehp.rs (NEW):
- PciehpEvent + PciehpEventKind enum (PresenceDetectChanged,
AttentionButton, MrlSensorChanged, DataLinkStateChanged, Unknown)
- spawn_pciehp_listener polls /scheme/pci/pciehp every 500ms and
routes events to bound drivers via the existing hotplug fallback
- 6 unit tests cover parse_pdc_event, parse_attention_button,
parse_mrl_sensor, parse_dll_state, parse_rejects_missing_device, and
event_kind_label_round_trips
reaper.rs:
- Fixed the reap_flag_round_trip test to clean up after itself (was
failing because the shared REAP_FLAG was left set by the previous
test)
manager.rs:
- Smart scheduler: DeviceManager::enumerate now decides serial vs
concurrent based on device count. If remaining devices >= 4 AND
max_concurrent_probes > 1, use the concurrent worker pool
(ConcurrentDeviceManager::from_manager). Otherwise, use serial.
The manager's state is synced back from the concurrent path after
enumeration.
concurrent.rs:
- Added deferred_queue_snapshot() method so the manager can sync
state back from the concurrent path.
Test totals: 46 tests across 4 crates, all passing.
§ 0.5 audit gate: 0 violations across 38 files.
Seventh-round integrations of the driver-manager migration's D-phase.
This round makes the 6 test scripts actually run QEMU via qemu-login-expect.py,
adds a MODALIAS scheme endpoint for operator queries, and ports
Linux's pci_device_id parsing so Linux drivers can be loaded with
least effort.
Test scripts (6, all functional now):
- test-driver-manager-parity.sh (C1 dual-mode observation): runs QEMU with
redbear-mini live.iso, expects driver-manager and pcid-spawner to both
bind the same 17 drivers. Exits 0 on PASS, 1 on FAIL, 0 on SKIP
(QEMU not available).
- test-driver-manager-active.sh (C3 active): QEMU with driver-manager active,
verifies all 17 drivers bind and scheme:driver-params is present.
- test-driver-manager-initfs.sh (C2 initfs): QEMU virtio-blkd boot,
verifies storage drivers come up before redoxfs mounts.
- test-driver-manager-hotplug.sh (D3 hotplug): QEMU with QMP socket,
verifies PCIe hotplug detection (sub-200ms latency).
- test-driver-manager-pm.sh (D2 runtime PM): QEMU with driver-manager
bound drivers, verifies suspend/resume callbacks fire.
- test-driver-manager-cutover.sh (C4 production): QEMU 3-reboot bound-set
identity check.
modalias.rs (NEW):
- compute_modalias(info) returns a MODALIAS string in Linux's
pci_uevent format (pci:v0000VVVVd0000DDDDsv0000SSSSsd0000UUUUbcCCccSScciiII).
- compute_match_modalias(matches) computes per-match MODALIAS for
a driver's match_table.
linux_loader.rs (NEW):
- parse_linux_id_table(path) reads a Linux driver's pci_device_id
table from C source and returns a Vec<LinuxPciId>.
- parse_linux_id_table_from_source(source) parses from a string.
- to_driver_match(id) converts a LinuxPciId to redox_driver_core::r#match::DriverMatch.
- Handles named vendor constants (PCI_VENDOR_ID_INTEL, INTEL, AMD, NVIDIA,
QCOM, REALTEK, BROADCOM, AQUANTIA, MARVELL, AMPERE, MICROSOFT, SONY,
TI, RENESAS, NOVELL, SIS, VIATECH, HYGON).
- Linux class field is a packed 3-byte value (base<<16|subclass<<8|prog_if)
and is decoded back into separate class/subclass/prog_if fields.
scheme.rs:
- Added /modalias endpoint. Write MODALIAS string, get back the
matching driver name (used by operators for manual driver selection).
main.rs:
- Declared modalias.rs and linux_loader.rs.
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v1.9 status table
- D5-AUDIT.md v1.9 update
- AGENTS.md + docs/README.md pointers to v1.9
Test totals: 39 tests across 4 crates, all passing.
§ 0.5 audit gate: 0 violations across 38 files.
Also: btusb firmware download command sequence + plan doc updates.
- btintel.rs extended: firmware_download_commands() generates the
full HCI command sequence for SFI firmware download (CSS header +
PKey + Signature + payload fragments). RSA and ECDSA header types
supported. secure_send_commands() splits data into 252-byte
fragments with type prefix. extract_boot_param() finds the
CMD_WRITE_BOOT_PARAMS record in firmware data. 5 new unit tests
(160 total pass).
- acpid/scheme.rs: ThermalZone handle kind for per-zone ACPI thermal
data. /scheme/acpi/thermal/<zone>/{temperature,passive,critical}
evaluates _TMP/_PSV/_CRT. thermald can now read real thresholds.
- Plan doc: Phase 7.1 updated with download command sequence.
ACPICA assessment updated with thermal zone methods.
Sixth-round integrations of the driver-manager migration's D-phase.
Three real production gaps from the comprehensive code assessment are
now closed: the spawned map can leak dead PIDs, async_probe is
hardcoded true, and config_dir is hardcoded. Four real unit tests
are added to concurrent.rs.
reaper.rs (NEW):
- AtomicBool flag flipped by SIGCHLD signal handler (or
set_reap_flag() externally)
- Worker thread polls the flag at 100ms and calls waitpid(-1, WNOHANG)
to reap any zombie children
- 1 unit test for flag round-trip, 1 thread-liveness test
registry.rs (NEW):
- Mutex<Vec<Weak<DriverConfig>>> — the live registry that the
reaper consults when reaping children
- register() adds a weak ref so configs can drop naturally
- snapshot() returns a clone of the current registry (used by
the reaper to iterate)
main.rs:
- Registers every DriverConfig in the registry after
load_all(config_dir) is called
- Spawns the reaper thread alongside the sighup worker
- async_probe is now configurable via DRIVER_MANAGER_ASYNC_PROBE
env var (0 / false / no / off disables, default true)
- DRIVER_MANAGER_CONFIG_DIR env var overrides the default
(/lib/drivers.d or /scheme/initfs/lib/drivers.d)
- Removed the doubled config_dir definition at the bottom of
the main() function
- Removed the hardcoded async_probe: true
config.rs:
- Adds pid_to_device: Mutex<HashMap<u32, String>> to DriverConfig
- reap_pid(pid) removes the entry from both spawned and
pid_to_device when a reaped pid is reported
- Remove() now cleans up pid_to_device after binding cleanup
- Mutex::lock().unwrap() replaced with
unwrap_or_else(|e| e.into_inner()) for consistency with main.rs
Cargo.toml:
- Adds libc = 0.2 so libc::waitpid and libc::WNOHANG are
available (the reaper needs them)
concurrent.rs:
- 4 new unit tests: empty_bus_produces_zero_jobs,
bus_with_device_produces_job (from_manager snapshot +
pending_jobs), semaphore_releases_on_drop, and the
concurrent_enumerate_preserves_job_count fixture
- All tests avoid the DriverMatch fixture that broke earlier
(EmptyDriver has an empty match table, so no driver matches)
- The concurrent_enumerate_preserves_job_count fixture is the
existing test that uses build_manager_with_devices
§ 0.5 audit gate: 0 violations across 38 files.
Test totals: 71 tests across 4 crates, all passing.
Also update LG Gram plan doc: ACPICA assessment (port algorithms,
not the C library), pcid assessment (correct, no changes needed),
Phase 9.1 marked partial (LPIT + _PRW + S0-idle done; MWAIT loop
remains), status updated to reflect completed phases.
Investigated the bootstrap thread bring-up needed for Design A
(worker-offload). Finding: `rlct_clone_impl` requires a fully-built TCB
for the new thread, but bootstrap's freestanding redox_rt has no
Tcb::new / TLS allocator / thread shim (only initialize_freestanding's
single TCB). So Design A needs, as a prerequisite, a freestanding
thread-spawn helper in redox_rt (its own task) — open-coding TCB/TLS in
initnsmgr is not acceptable.
Revised ordering: keep Step 1 (Arc<Mutex> Send refactor, inert until A),
boot-validate on idle + commit; then prefer Design B (kernel O_NONBLOCK
on open + single-thread deferred, no bootstrap threads) as the first
functional step; Design A later once redox_rt grows the freestanding
thread helper. All still require an idle host to validate.
Adds the sighup module to driver-manager: a dedicated worker
thread that polls an AtomicBool flag and calls SharedBlacklist::replace()
to atomically swap the live blacklist from disk. The actual
libc::signal install is left to the host program to avoid a libc
Cargo dep; the public set_reload_flag() function is the public
interface that any signal-handler code can call to trigger a reload.
sighup.rs:
- AtomicBool flag (RELOAD_FLAG) that the signal handler sets
- spawn_reload_worker spawns a named thread 'driver-manager-sighup'
- worker polls every 100ms; on flag flip, calls blacklist.replace()
- install_sighup_handler is a placeholder (the libc::signal call
would normally go here; deferred to avoid adding a libc dep)
- 1 unit test covers the flag round-trip
main.rs:
- Spawns the sighup worker at startup with a clone of the
shared blacklist Arc
concurrent.rs:
- Trivial whitespace-only change from earlier round
(DriverMatch type cleanup)
Test totals: 67 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 38 files.
Docs: DRIVER-MANAGER-MIGRATION-PLAN.md v1.7 header + status table;
D5-AUDIT.md v1.7; HARDWARE-VALIDATION-MATRIX.md adds SIGHUP row;
AGENTS.md + docs/README.md pointers to v1.7.
Fourth-round integrations of the driver-manager migration's D-phase.
Three new modules in driver-manager: heartbeat, aer, plus a
SharedBlacklist wrapper around the existing Blacklist that supports
live reload.
heartbeat.rs:
- Heartbeat struct with a publishing thread that writes a JSON
status line to /var/run/driver-manager.heartbeat.json every 5s
- Tracks bound / deferred / spawned / unbound / on_error counters
- 3 unit tests cover counter updates, JSON output, and clone semantics
aer.rs:
- AER (PCI Express Advanced Error Reporting) listener thread
- Reads /scheme/acpi/aer for events (parses severity + device bdf)
- Routes to bound driver via scheme:driver-manager lookup
- Returns RecoveryAction (Handled / ResetDevice / RescanBus) based
on severity
- Falls back to log-and-no-op when /scheme/acpi is absent
- 7 unit tests cover parsing, routing, and severity mapping
policy.rs:
- Adds SharedBlacklist = Arc<RwLock<Blacklist>> + source_path
- Supports live reload via replace() (re-reads from source_path)
- is_blacklisted() takes a read lock (lock-free for the probe hot path)
- set_global_shared_blacklist in config.rs wires it into the manager
- 2 new unit tests cover replace() and snapshot isolation
main.rs:
- Spawns the heartbeat thread at startup (file at /var/run)
- Constructs the SharedBlacklist from the policy directory
config.rs:
- Replaces GLOBAL_BLACKLIST OnceLock<Blacklist> with
OnceLock<SharedBlacklist>; the probe hot path reads via
Arc<RwLock>, not the OnceLock directly
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v1.6 status table (64 tests)
- D5-AUDIT.md v1.6 update
- HARDWARE-VALIDATION-MATRIX.md adds heartbeat and AER rows
- AGENTS.md + docs/README.md pointers to v1.6
Test totals: 64 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 37 files.
SIGHUP trampoline for the SharedBlacklist is left for a future round;
the replace() infrastructure is in place today so an operator can
add the signal handler without changing the policy module.
Third-round integrations of the driver-manager migration's D-phase.
The pcid_interface crate (in local/sources/base submodule, see
upstream commit ddcd0870) now reads REDBEAR_DRIVER_PCI_IRQ_MODE
and REDBEAR_DRIVER_DISABLE_ACCEL at connect_default time, exposing
them as PciFunctionHandle accessors. The quirk integration is
end-to-end: driver-manager emits the env vars on spawn, pcid_interface
parses them, and the child driver reads the hints from its
PciFunctionHandle.
driver-manager (16 tests, unchanged count + 3 new for observability):
- main.rs: --list-drivers prints the config table, --dry-run
prints how many drivers would-bind/defer/blacklisted without
spawning, --export-blacklist prints the loaded blacklist.
- policy.rs: adds blacklist_module_names() iterator for export.
driver-manager v1.5 quirks.rs (created earlier at v1.4 PciQuirkFlags
work) is in the staging area and is unchanged this round.
local/scripts/driver-manager-audit-no-stubs.py:
- Drops R4 (was: 'let _ = ...' no-op detection) because Rust's
'let _ = expression' is idiomatic and not actually a stub.
- Adds R5 (stub-macro callbacks: unimplemented!/todo!/unreachable!
in callback / fn bodies) to detect dead-end fallbacks.
- Audit gate now reports 0 violations across 35 files (was 34,
pcid_interface is now in scope).
local/sources/base submodule pointer: updated to upstream commit
ddcd0870 (the pcid_interface env-var-reading commit).
Test totals: 58 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 35 files.
Base submodule bump (6db0f481): hardware-correct DesignWare engine
(disable/program/enable ordering, abort-first polling, corrected SCL
timing, recovery, validation) and proper Intel LPSS PCI bring-up.
- iwlwifi candidate tables: remove the c-prefixed iwlmld series from
the current Mini-MVM candidate lists — the MVM transport cannot
drive MLD firmware, and selecting it would fail firmware boot
instead of falling back to a compatible image (review MAJOR). c-series
returns with the MLD op-mode (Phase 6/W). Fallback TOML chains no
longer mix MLD and MVM series.
- redbear-iwlwifi + redbear-wifictl candidate detection now probes
both the flat /lib/firmware/iwlwifi-* and the post-2026
/lib/firmware/intel/iwlwifi/ layouts (review MAJOR).
- plan doc: review-fix round recorded; precision fixes — amd-mp2-i2cd
remains registration-only until its mailbox engine lands, and the
system-quirk flags parse but have no consumers until Phase 5.
Validation: iwlwifi 8 + wifictl 21 tests pass, base cooks for
x86_64-unknown-redox.
- Bump submodule/base to the acpid AML-handler hardening (bounded stall,
mutex owner-check, static _PSS/_PSD/_CST/_CPC cache, panic-free scheme
path, observability). Proven NOT a regression: a mutex-only baseline
wedges identically under load in a 3/3 framebuffer-ground-truth test,
so the residual under-load boot wedge is head-of-line blocking in
initnsmgr, not acpid.
- Add local/docs/INITNSMGR-CONCURRENCY-DESIGN.md: the concrete
worker-offload design (Design A) that decouples the blocking openat
from the initnsmgr dispatch loop, plus Design B (kernel O_NONBLOCK +
deferred single-thread), a staged plan, and validation rules. Key
finding baked in: redox_rt's Mutex is a spinlock, so the cap_fd must be
resolved under a short lock and the openat run with the lock released.
- Update INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md with the acpid
hardening section (done vs the still-deferred #1 transport decoupling).
- Add local/patches/wip-initnsmgr/step1-send-refactor.patch: the
compiled-but-not-yet-boot-validated Step 1 (Rc<RefCell> -> Arc<Mutex>
Send refactor) of initnsmgr, saved durably. It is intentionally NOT in
the base gitlink: bootstrap is the earliest-boot component and this
must be boot-validated on an idle host (the current host is under heavy
external load) before landing. Steps 2-5 (worker bring-up) likewise
need an idle host.
Round-two integrations of the driver-manager migration's D-phase.
The policy loader is now active (the redbear-driver-policy package
now actually changes spawn_decision_gate behavior at runtime), the
--concurrent=N CLI flag enables the SMP worker pool, PciQuirkFlags
is wired into actual driver spawn (env vars to the child), and the
two C0 service files have been committed in the local/sources/base
submodule. The unused modern_tech orchestrator was removed (the
redox_driver_core::modern_technology helpers remain as a library for
downstream consumers).
driver-manager (16 tests, was 13):
- config.rs: PciQuirkFlags hints are now passed to the spawned child as
env vars (REDBEAR_DRIVER_PCI_IRQ_MODE=intx_or_msi, REDBEAR_DRIVER_DISABLE_ACCEL=1).
Adds blacklist_match() consult at probe time before spawn_decision_gate.
- main.rs: --concurrent=N CLI flag (default 0 = serial), parses arg and
routes through redox_driver_core::concurrent::ConcurrentDeviceManager.
Loads /etc/driver-manager.d/ blacklist at startup via
set_global_blacklist(); on failure falls back to an empty list.
- policy.rs: new file. BlacklistFile / BlacklistEntry TOML schema,
load_dir() reads .toml/.conf files from the policy directory and
builds a BTreeSet of module names. Missing directory returns empty
(opt-in). Tests cover missing / valid / invalid-file paths.
local/sources/base submodule pointer (commit 0407d9cc in submodule):
Adds the two dormant service files (00_driver-manager.service in
init.d/ and 40_driver-manager-initfs.service in init.initfs.d/).
Both are gated by ConditionPathExists=!/etc/driver-manager.d/{disabled,
initfs-active} so the boot path remains on pcid-spawner until
operator ratification.
redox-driver-core: unchanged library. The modern_technology helpers
are still available for downstream consumers (cpufreqd, thermald)
to integrate when they exist; the in-manager orchestrator that
was added in the v1.3 round has been removed because it wrote JSON
files that nothing read.
§ 0.5 audit-no-stubs.py: 0 violations across 34 files. 52 tests pass
across the three crates.
Base submodule bump (452452e4): the I2C transfer chain was stubbed
end-to-end and is now real code — dw-i2c DesignWare engine ported from
Linux 7.1, intel-lpss-i2cd PCI discovery for ARL-H/MTL-P, i2cd provider
routing.
Config fixes for the chain:
- drivers.d spawn paths: six entries pointed at /usr/lib/drivers/ for
binaries staged at /usr/bin/ (i2cd, gpiod, dw-acpi-i2cd, intel-gpiod,
i2c-gpio-expanderd, i2c-hidd) — those drivers would never spawn.
- init services: add 00_intel-lpss-i2cd.service
(type = { scheme = "i2c-lpss" }, absolute cmd path since init PATH
covers only /usr/bin); dw-acpi-i2cd upgraded from oneshot_async to
type = { scheme = "dw-acpi-i2c" } now that it serves a scheme
forever; i2c-hidd requires_weak gains 00_intel-lpss-i2cd.service so
the touchpad adapter exists before HID probing.
Validation: base cooks for x86_64-unknown-redox; staged binary paths
verified against spawn configs; make lint-config clean.
Refs: local/docs/LG-GRAM-16Z90TP-COMPATIBILITY-PLAN.md Phase 4
vasilito