- base bump (b0e76065): pcid PCI 3.0 fallback no longer panics on
extended config reads (returns 0xFFFFFFFF, drops writes).
- redox-driver-pci PciBus reads only the 64-byte standard header it
consumes (vendor/device/class/subsystem), instead of the whole 4 KiB
config file per device per poll cycle — safe on MCFG-less machines
and cheaper everywhere.
The src/ directory held a July-10 snapshot of the crate from before
dynids, the concurrent path, and the modern-technology helpers — a
duplicate that could only mislead. The canonical tree is
local/recipes/drivers/redox-driver-core/source/src/.
Plan v3.1 records the completed P0/LDR/P2 work program and the
operator-ratified cutover (driver-manager owns the boot path in all
redbear-* configs; pcid-spawner gated as fallback). Assessment § 11
documents the OS-services integration: init ConditionPathExists gate,
live driver-params bridge, udev-shim driver-binding gap (P3), and the
correct absence of D-Bus (bridge-on-demand pattern).
Operator-ratified cutover (the D5/C-phase gate):
- redbear-device-services.toml: driver-manager added to [packages]
(was 'intentionally not included'); /lib/drivers.d/70-wifi.toml
staged (redbear-iwlwifi --daemon); stale pre-cutover comments
replaced with the single-spawner invariant for driver-manager.
- redbear-mini.toml: /etc/init.d override now stages
00_driver-manager.service (--hotplug, gated !disabled) instead of
00_pcid-spawner.service; all requires_weak references switched to
00_driver-manager.service.
- redbear-full.toml, redbear-greeter-services.toml: same requires_weak
switch for iommu, greeter, SDDM.
- base submodule bump (c72d4247): init.d/init.initfs.d service gates —
pcid-spawner services start only when
/etc/driver-manager.d/disabled exists (operator fallback, never
deleted); driver-manager services run by default.
make lint-config: OK — no init service path violations.
init now supports systemd-style ConditionPathExists (with ! negation)
in service files, and the C0 driver-manager service file has correct
polarity. The C0 dormancy is now by design (condition gate) instead of
by parser rejection accident.
LDR-2 (spawned mode): linux-kpi pci_register_driver now honors
PCID_CLIENT_CHANNEL — when spawned by driver-manager (or pcid-spawner)
it probes only the granted device and never enumerates, making the
manager the single owner of match-claim-spawn. Standalone
self-enumeration remains for CLI tools. redox-driver-sys
parse_scheme_entry is now pub.
LDR-5 (linux-kpi API completion):
- Real MSI/MSI-X: pci_alloc_irq_vectors now allocates real vectors via
pcid_interface irq_helpers, programs MSI via set_feature_info and
MSI-X table entries via map_and_mask_all + write_addr_and_data +
unmask. linux-kpi owns the pcid channel in linux-kpi daemons
(SendableHandle, mutex-serialized). LEGACY path keeps real INTx.
- pci_request_regions/pci_release_regions (BAR validation + tracking).
- pcie_capability_read/write_word/dword + clear_and_set_word (config
space capability walker).
- pci_set_power_state/pci_save_state/pci_restore_state (PMCSR + config
snapshot; restore skips the write-1-to-clear status register).
- C header declarations synced.
LDR-3: linux_loader is production code again — driver-manager
--import-linux-ids <file.c> parses a Linux pci_device_id table and
emits [[driver.match]] TOML. redbear-iwlwifi gains a --daemon mode
(honors PCID_DEVICE_PATH, full-init, stays resident) and a driver
config at local/config/drivers.d/70-wifi.toml.
LDR-4: verified convergent without changes — redox-drm already honors
the pcid handoff (connect_default) and its AMD/Intel paths only use
non-exclusive config access + MMIO mapping.
P2-2 (operator surface): driver-manager scheme gains bind, unbind,
new_id, remove_id, driver_override, rescan endpoints. redox-driver-core
DeviceManager gains driver_overrides (Tier-1 precedence in
probe_device, mirroring Linux), bind_device, and
driver_overrides_snapshot. parse_new_id has 5 host tests.
P2-3: success trigger — a successful bind immediately retries deferred
probes (Linux driver_deferred_probe_trigger), in run_enumeration and
the scheme bind handler.
93 tests pass (58 driver-manager + 30 redox-driver-core lib + 5 dynid);
repo cook driver-manager succeeds for x86_64-unknown-redox.
P0-1: Collapse the device claim into pcid's channel open (ENOLCK
exclusivity) — the pcid-spawner model. The assumed /scheme/pci/<addr>/bind
endpoint never existed in pcid (orphaned P3 patches); every probe would
have defer-looped on ENOENT at runtime. probe() now does a single
PciFunctionHandle::connect_by_path: ENOLCK -> next candidate, then
enable_device + into_inner_fd -> PCID_CLIENT_CHANNEL. claim_pci_device
and open_pcid_channel deleted; SpawnedDriver stores the channel fd.
P0-2: Resolve orphaned patches per the decision tree:
P3-pcid-bind-scheme.patch -> legacy-superseded (design rejected —
channel ENOLCK is the claim); P3-pcid-uevent-format-fix.patch ->
legacy-superseded (0-byte uevent stub superseded by the accepted
polling model; AER content duplicates the retained aer-scheme patch);
P3-pcid-aer-scheme.patch retained as the P2-1 producer blueprint.
SUPERSEDED.md audit log added.
P0-3: Remove advisory theater and suppressed dead code:
- modern_tech.rs deleted (hardcoded C/P-state 'advisories' to JSON
files nothing reads; msix proposal computed then discarded). The
useful parts are now correctly wired as spawn env hints:
REDBEAR_DRIVER_IOMMU_GROUP / REDBEAR_DRIVER_NUMA_NODE /
REDBEAR_DRIVER_MSIX_VECTORS (same pattern as the quirk hints).
- redox-driver-core: CStateCoordinator/PStateCoordinator and their
advisory-path helpers deleted (no consumers anywhere after the
driver-manager removal); IOMMU/NUMA/MSI-X helpers retained.
- exec.rs deleted (dead spawn_driver with #[allow(dead_code)]).
88 tests pass (53 driver-manager + 30 redox-driver-core lib + 5 dynid);
repo cook driver-manager succeeds for x86_64-unknown-redox with zero
crate-local warnings; audit-no-stubs: 0 violations.
- redox-driver-core: DeviceManager stores drivers as Arc<dyn Driver>;
ConcurrentDeviceManager jobs carry priority-ordered candidate lists
(static match + dynids); workers invoke the real Driver::probe() with
serial-equivalent per-device semantics. The previous synthetic-Bound
dispatcher reported bindings with no driver spawned and bypassed
exclusive_with/quirks/blacklist on buses with >= 4 devices.
- scheme.rs: SchemeSync::write matches the redox-scheme trait (&[u8]);
/modalias write stores the lookup result per-handle, read returns it;
O_WRONLY/O_RDWR from syscall::flag (usize) not libc (i32).
- config.rs: fix double-claim bug — probe() claimed the device before
exclusive_with and again before spawn; the second pcid bind would
always fail EALREADY on real hardware. One claim threaded to spawn.
- main.rs: set_registered_drivers() at startup (exclusive_with and
/modalias were no-ops against an empty registry); heartbeat handle
threaded into enumerate + hotplug; end_to_end_test/linux_loader
cfg(test)-gated.
- reaper.rs/sighup.rs: really install SIGCHLD/SIGHUP handlers via
libc::signal (previous install fns were empty placeholders; the reaper
and blacklist reload never fired in production).
- unified_events.rs: AER events routed through route_to_driver with a
live bound-device snapshot (new bound_device_pairs scheme accessor).
- Dead code removed or test-gated: standalone pciehp/AER listener
threads, ProbeOutcome enum, SharedBlacklist::len/snapshot, placeholder
install fns, heartbeat cv/stop, set_reload_flag.
- 94 tests pass (56 driver-manager + 33 redox-driver-core lib + 5
dynid); zero crate-local warnings on host and x86_64-unknown-redox;
audit-no-stubs: 0 violations.
Document once and for all that ./local/scripts/build-redbear.sh is the
sole sanctioned way to build Red Bear OS, any package, or any target
artifact. Forbid cargo check/build/clippy in source trees, cargo test
--target in source trees, and repo cook / make r.* / make all / make live
as build substitutes (they skip prefix-staleness detection, fingerprint
tracking, the concurrency lock, branch gates, and stash-and-restore).
Host unit tests (cargo test, no --target) for pure-logic crates are the
single sanctioned test alternative. Explain WHY the script is the build
(concurrency lock, prefix rebuild, stash-and-restore, branch gate,
fingerprints, config parsing). Mark repo cook/make r.* as DIAGNOSTIC
ONLY. Give the correct per-component verification flow.
- btintel.rs: run_intel_command() sends a command and waits for the
matching command-complete (opcode + status check). intel_read_version()
parses the Intel version response. intel_download_firmware() streams
the full SFI command sequence (CSS header + PKey + signature + payload
fragments), rejecting on controller NACK. intel_setup_firmware()
orchestrates bootloader detection -> enter MFG -> download -> exit MFG
-> DDC apply -> version re-read. apply_ddc_config() replays the DDC
command records. read_firmware_blob() probes scheme and /lib/firmware
(flat + intel/ layouts).
- main.rs: wire intel_setup_firmware into daemon_main for Intel CNVi
adapters (vendor 0x8087) before standard HCI init; no-op on
operational controllers, non-fatal on failure.
- 4 new tests (download ACK/NACK, opcode match/mismatch); 164 total pass.
Ported from Linux drivers/bluetooth/btintel.c.
Ninth-round integrations of the driver-manager migration's D-phase.
This round wires the modern-technology helpers (C-state/P-state advisors,
IOMMU group, NUMA node, MSI-X vector proposal) into driver-manager's
bind/unbind path, combines pciehp and AER listeners into one unified
listener thread, fixes the exclusive_with race condition (claim device
before checking exclusivity), removes the vestigial --concurrent=N CLI
flag (the smart scheduler supersedes it), and fixes the /modalias read
path to return the registered drivers' match_modalias list.
modern_tech.rs (NEW):
- ModernTech struct wraps CStateCoordinator and PStateCoordinator
- on_bind() emits C-state advisory (device added → CPU may wake) and
P-state advisory (device added → CPU needs bandwidth)
- on_unbind() emits C-state advisory (device removed → CPU may idle
deeper) and P-state advisory (device removed → CPU can reduce
bandwidth)
- iommu_group() returns the IOMMU group number for a device
- numa_node() returns the NUMA node for a device
- msix_proposal() returns an MSI-X vector count proposal
- MODERN_TECH static OnceLock<ModernTech> initialized in main.rs
- 3 unit tests cover on_bind_skips_non_pci, on_bind_emits_advisories_for_pci,
and default_constructor_works
main.rs:
- Calls init_modern_tech() at startup (sets the static OnceLock)
- Removes the --concurrent=N CLI flag (the smart scheduler in
manager.rs::enumerate() supersedes it)
- Calls unified_events::spawn_unified_listener() instead of separate
aer::spawn_aer_listener() and pciehp::spawn_pciehp_listener()
(combines both into one thread)
config.rs:
- probe() now claims the device BEFORE checking exclusive_with
(fixing the race where another probe could claim the device between
the exclusivity check and the claim)
- exclusive_with is now atomic because the claim is atomic
- Adds on_bind() call to modern_tech with iommu_group, numa_node, and
msix_proposal logged
- Adds on_unbind() call to modern_tech when a driver exits cleanly
unified_events.rs (NEW):
- UnifiedEvent enum wraps AerEvent and PciehpEvent
- spawn_unified_listener polls /scheme/acpi/aer and /scheme/pci/pciehp
every 500ms from one thread (replaces the two separate polling loops)
- 2 unit tests cover event wrapping
scheme.rs:
- /modalias read path now returns the registered drivers'
match_modalias list instead of a static hint message
- write() method now takes buf: &mut [u8] (mutable) for the write path
- openat allows O_RDONLY, libc::O_WRONLY, and libc::O_RDWR for the
modalias write path
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v2.1 status table
- D5-AUDIT.md v2.1 update
- HARDWARE-VALIDATION-MATRIX.md driver-manager rows updated
- AGENTS.md + docs/README.md pointers to v2.1
Test totals: 51 tests across 4 crates, all passing.
§ 0.5 audit gate: 0 violations across 38 files.
The recipe adds a forkpty extern to the libc crate's Redox module (which
relibc provides but the libc crate does not declare) so nix 0.30.1's pty
module compiles. The sed anchor was `)-> c_int;` (no space), which
matched older libc formatting but NOT libc 0.2.189's multi-line openpty
close `) -> c_int;` (with space) — pulled in by the latest-upstream rule.
The sed silently no-op'd, forkpty was never declared, and nix failed with
"cannot find function forkpty in crate libc", breaking the mini build.
Fix: anchor `) *-> c_int;` (optional space) matches both the old and new
formatting. Verified: clean uutils-tar build compiles nix and finishes.
Note on the stale-rlib symptom seen during diagnosis: cargo fingerprints
registry crates by version, not source content, so a libc rlib compiled
while the anchor was broken (forkpty absent) is reused even after the
source is patched. A clean/target-wiped build recompiles correctly; the
anchor fix is the durable root fix.
Eighth-round integrations of the driver-manager migration's D-phase.
This round closes the remaining gaps from the v1.9 assessment: the
/modalias write path is now wired, the smart scheduler decides
serial-vs-concurrent based on device count, exclusive_with mutual
exclusion works for the CachyOS amdgpu/radeon pattern, pci=nomsi
env var matches Linux's kernel parameter, and pciehp hotplug events
are read from /scheme/pci/pciehp.
scheme.rs:
- Added /modalias write path. Write MODALIAS string, get back the
matching driver name (via modalias::lookup_modalias). The endpoint
is now a real read/write interface, not a static hint.
modalias.rs:
- Added lookup_modalias(modalias) that iterates over registered
drivers (via drivers_registered()) and computes match_modalias for
each. Returns the driver's name if a match is found.
config.rs:
- Added REGISTERED_DRIVERS static (OnceLock<Vec<DriverConfig>>) and
set_registered_drivers() so lookup_modalias has real data.
- Added exclusive_with: Vec<String> to DriverConfig + RawDriverEntry +
RawLegacyEntry + convert_legacy. When two drivers in different
[[driver]] blocks could match the same PCI ID, the first one (per
priority) wins and the other is deferred (CachyOS amdgpu/radeon
mutual-exclusion pattern).
- Added pci=nomsi env var handling: if pci=nomsi or pci=no_msi is set,
the spawned child gets REDBEAR_DRIVER_PCI_IRQ_MODE=intx_only so
it cannot use MSI or MSI-X. Matches Linux's pci=nomsi kernel parameter.
main.rs:
- Declared pciehp module. Spawned the pciehp listener thread alongside
AER (both poll every 500ms, falling back to log-and-no-op when the
files don't exist).
pciehp.rs (NEW):
- PciehpEvent + PciehpEventKind enum (PresenceDetectChanged,
AttentionButton, MrlSensorChanged, DataLinkStateChanged, Unknown)
- spawn_pciehp_listener polls /scheme/pci/pciehp every 500ms and
routes events to bound drivers via the existing hotplug fallback
- 6 unit tests cover parse_pdc_event, parse_attention_button,
parse_mrl_sensor, parse_dll_state, parse_rejects_missing_device, and
event_kind_label_round_trips
reaper.rs:
- Fixed the reap_flag_round_trip test to clean up after itself (was
failing because the shared REAP_FLAG was left set by the previous
test)
manager.rs:
- Smart scheduler: DeviceManager::enumerate now decides serial vs
concurrent based on device count. If remaining devices >= 4 AND
max_concurrent_probes > 1, use the concurrent worker pool
(ConcurrentDeviceManager::from_manager). Otherwise, use serial.
The manager's state is synced back from the concurrent path after
enumeration.
concurrent.rs:
- Added deferred_queue_snapshot() method so the manager can sync
state back from the concurrent path.
Test totals: 46 tests across 4 crates, all passing.
§ 0.5 audit gate: 0 violations across 38 files.
Seventh-round integrations of the driver-manager migration's D-phase.
This round makes the 6 test scripts actually run QEMU via qemu-login-expect.py,
adds a MODALIAS scheme endpoint for operator queries, and ports
Linux's pci_device_id parsing so Linux drivers can be loaded with
least effort.
Test scripts (6, all functional now):
- test-driver-manager-parity.sh (C1 dual-mode observation): runs QEMU with
redbear-mini live.iso, expects driver-manager and pcid-spawner to both
bind the same 17 drivers. Exits 0 on PASS, 1 on FAIL, 0 on SKIP
(QEMU not available).
- test-driver-manager-active.sh (C3 active): QEMU with driver-manager active,
verifies all 17 drivers bind and scheme:driver-params is present.
- test-driver-manager-initfs.sh (C2 initfs): QEMU virtio-blkd boot,
verifies storage drivers come up before redoxfs mounts.
- test-driver-manager-hotplug.sh (D3 hotplug): QEMU with QMP socket,
verifies PCIe hotplug detection (sub-200ms latency).
- test-driver-manager-pm.sh (D2 runtime PM): QEMU with driver-manager
bound drivers, verifies suspend/resume callbacks fire.
- test-driver-manager-cutover.sh (C4 production): QEMU 3-reboot bound-set
identity check.
modalias.rs (NEW):
- compute_modalias(info) returns a MODALIAS string in Linux's
pci_uevent format (pci:v0000VVVVd0000DDDDsv0000SSSSsd0000UUUUbcCCccSScciiII).
- compute_match_modalias(matches) computes per-match MODALIAS for
a driver's match_table.
linux_loader.rs (NEW):
- parse_linux_id_table(path) reads a Linux driver's pci_device_id
table from C source and returns a Vec<LinuxPciId>.
- parse_linux_id_table_from_source(source) parses from a string.
- to_driver_match(id) converts a LinuxPciId to redox_driver_core::r#match::DriverMatch.
- Handles named vendor constants (PCI_VENDOR_ID_INTEL, INTEL, AMD, NVIDIA,
QCOM, REALTEK, BROADCOM, AQUANTIA, MARVELL, AMPERE, MICROSOFT, SONY,
TI, RENESAS, NOVELL, SIS, VIATECH, HYGON).
- Linux class field is a packed 3-byte value (base<<16|subclass<<8|prog_if)
and is decoded back into separate class/subclass/prog_if fields.
scheme.rs:
- Added /modalias endpoint. Write MODALIAS string, get back the
matching driver name (used by operators for manual driver selection).
main.rs:
- Declared modalias.rs and linux_loader.rs.
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v1.9 status table
- D5-AUDIT.md v1.9 update
- AGENTS.md + docs/README.md pointers to v1.9
Test totals: 39 tests across 4 crates, all passing.
§ 0.5 audit gate: 0 violations across 38 files.
Also: btusb firmware download command sequence + plan doc updates.
- btintel.rs extended: firmware_download_commands() generates the
full HCI command sequence for SFI firmware download (CSS header +
PKey + Signature + payload fragments). RSA and ECDSA header types
supported. secure_send_commands() splits data into 252-byte
fragments with type prefix. extract_boot_param() finds the
CMD_WRITE_BOOT_PARAMS record in firmware data. 5 new unit tests
(160 total pass).
- acpid/scheme.rs: ThermalZone handle kind for per-zone ACPI thermal
data. /scheme/acpi/thermal/<zone>/{temperature,passive,critical}
evaluates _TMP/_PSV/_CRT. thermald can now read real thresholds.
- Plan doc: Phase 7.1 updated with download command sequence.
ACPICA assessment updated with thermal zone methods.
Sixth-round integrations of the driver-manager migration's D-phase.
Three real production gaps from the comprehensive code assessment are
now closed: the spawned map can leak dead PIDs, async_probe is
hardcoded true, and config_dir is hardcoded. Four real unit tests
are added to concurrent.rs.
reaper.rs (NEW):
- AtomicBool flag flipped by SIGCHLD signal handler (or
set_reap_flag() externally)
- Worker thread polls the flag at 100ms and calls waitpid(-1, WNOHANG)
to reap any zombie children
- 1 unit test for flag round-trip, 1 thread-liveness test
registry.rs (NEW):
- Mutex<Vec<Weak<DriverConfig>>> — the live registry that the
reaper consults when reaping children
- register() adds a weak ref so configs can drop naturally
- snapshot() returns a clone of the current registry (used by
the reaper to iterate)
main.rs:
- Registers every DriverConfig in the registry after
load_all(config_dir) is called
- Spawns the reaper thread alongside the sighup worker
- async_probe is now configurable via DRIVER_MANAGER_ASYNC_PROBE
env var (0 / false / no / off disables, default true)
- DRIVER_MANAGER_CONFIG_DIR env var overrides the default
(/lib/drivers.d or /scheme/initfs/lib/drivers.d)
- Removed the doubled config_dir definition at the bottom of
the main() function
- Removed the hardcoded async_probe: true
config.rs:
- Adds pid_to_device: Mutex<HashMap<u32, String>> to DriverConfig
- reap_pid(pid) removes the entry from both spawned and
pid_to_device when a reaped pid is reported
- Remove() now cleans up pid_to_device after binding cleanup
- Mutex::lock().unwrap() replaced with
unwrap_or_else(|e| e.into_inner()) for consistency with main.rs
Cargo.toml:
- Adds libc = 0.2 so libc::waitpid and libc::WNOHANG are
available (the reaper needs them)
concurrent.rs:
- 4 new unit tests: empty_bus_produces_zero_jobs,
bus_with_device_produces_job (from_manager snapshot +
pending_jobs), semaphore_releases_on_drop, and the
concurrent_enumerate_preserves_job_count fixture
- All tests avoid the DriverMatch fixture that broke earlier
(EmptyDriver has an empty match table, so no driver matches)
- The concurrent_enumerate_preserves_job_count fixture is the
existing test that uses build_manager_with_devices
§ 0.5 audit gate: 0 violations across 38 files.
Test totals: 71 tests across 4 crates, all passing.
Bumps base to include the pcid guard (out-of-range PCIe config offsets
return the no-response pattern / no-op instead of aborting pcid) plus
all the operator's ACPI-runtime, i2c, and ided work already on the
submodule branch. This unblocks boot past the previous pcid Invalid
opcode fault, through switchroot and the /usr driver set.
Also carries the earlier accidental commit of the initnsmgr Step 1
Send refactor (Rc<RefCell<Namespace>> -> Arc<sync::Mutex<Namespace>>),
now VALIDATED: a low-load boot progressed through all initfs units,
switchroot, and the /usr drivers via the Arc<Mutex> namespace manager
(hundreds of opens) with no regression. The residual under-load
head-of-line wedge is the known single-threaded initnsmgr issue tracked
in local/docs/INITNSMGR-CONCURRENCY-DESIGN.md (worker-offload / Design B).
Also update LG Gram plan doc: ACPICA assessment (port algorithms,
not the C library), pcid assessment (correct, no changes needed),
Phase 9.1 marked partial (LPIT + _PRW + S0-idle done; MWAIT loop
remains), status updated to reflect completed phases.
Investigated the bootstrap thread bring-up needed for Design A
(worker-offload). Finding: `rlct_clone_impl` requires a fully-built TCB
for the new thread, but bootstrap's freestanding redox_rt has no
Tcb::new / TLS allocator / thread shim (only initialize_freestanding's
single TCB). So Design A needs, as a prerequisite, a freestanding
thread-spawn helper in redox_rt (its own task) — open-coding TCB/TLS in
initnsmgr is not acceptable.
Revised ordering: keep Step 1 (Arc<Mutex> Send refactor, inert until A),
boot-validate on idle + commit; then prefer Design B (kernel O_NONBLOCK
on open + single-thread deferred, no bootstrap threads) as the first
functional step; Design A later once redox_rt grows the freestanding
thread helper. All still require an idle host to validate.
Investigation confirmed Intel display register offsets are IDENTICAL from
Gen8 (Skylake) through Gen14 (Meteor Lake): PIPECONF=0x70008,
PLANE_CTL=0x70180, PLANE_SURF=0x7019C, DDI_BUF_CTL=0x64000, HTOTAL=0x60000.
The only Gen14-specific branch is CHICKEN_TRANS. The original Phase 3.2
hypothesis (per-gen register offset tables) was therefore wrong.
The real gap for MTL was DMC (Display Microcontroller) firmware loading,
which is required for MTL display bringup. This commit adds:
- dmc.rs: Full DMC firmware parser supporting both v1 and v3 header
formats. Parses CSS header, package header, DMC header, validates
magic/version/checksum, then loads payload via MMIO into the DMC
SRAM regions defined by the DMC_PROGRAM() macro.
- DisplayPlatform enum (Gen9/11/12/13/14) with device-id-based
detection covering SKL, KBL, ICL, TGL, ADL, RPL, MTL platforms.
- try_load_dmc() entry point wired into IntelDriver::new() between
forcewake init and display init, matching the Linux i915 sequence.
- 5 unit tests covering header parsing, platform detection, and
payload validation.
Also fixes 4 pre-existing _mmio -> mmio references in virtio test code
that were blocking all test compilation in the redox-drm crate.
Verified: cargo check clean (zero errors, zero warnings from new code).
Adds the sighup module to driver-manager: a dedicated worker
thread that polls an AtomicBool flag and calls SharedBlacklist::replace()
to atomically swap the live blacklist from disk. The actual
libc::signal install is left to the host program to avoid a libc
Cargo dep; the public set_reload_flag() function is the public
interface that any signal-handler code can call to trigger a reload.
sighup.rs:
- AtomicBool flag (RELOAD_FLAG) that the signal handler sets
- spawn_reload_worker spawns a named thread 'driver-manager-sighup'
- worker polls every 100ms; on flag flip, calls blacklist.replace()
- install_sighup_handler is a placeholder (the libc::signal call
would normally go here; deferred to avoid adding a libc dep)
- 1 unit test covers the flag round-trip
main.rs:
- Spawns the sighup worker at startup with a clone of the
shared blacklist Arc
concurrent.rs:
- Trivial whitespace-only change from earlier round
(DriverMatch type cleanup)
Test totals: 67 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 38 files.
Docs: DRIVER-MANAGER-MIGRATION-PLAN.md v1.7 header + status table;
D5-AUDIT.md v1.7; HARDWARE-VALIDATION-MATRIX.md adds SIGHUP row;
AGENTS.md + docs/README.md pointers to v1.7.
Fourth-round integrations of the driver-manager migration's D-phase.
Three new modules in driver-manager: heartbeat, aer, plus a
SharedBlacklist wrapper around the existing Blacklist that supports
live reload.
heartbeat.rs:
- Heartbeat struct with a publishing thread that writes a JSON
status line to /var/run/driver-manager.heartbeat.json every 5s
- Tracks bound / deferred / spawned / unbound / on_error counters
- 3 unit tests cover counter updates, JSON output, and clone semantics
aer.rs:
- AER (PCI Express Advanced Error Reporting) listener thread
- Reads /scheme/acpi/aer for events (parses severity + device bdf)
- Routes to bound driver via scheme:driver-manager lookup
- Returns RecoveryAction (Handled / ResetDevice / RescanBus) based
on severity
- Falls back to log-and-no-op when /scheme/acpi is absent
- 7 unit tests cover parsing, routing, and severity mapping
policy.rs:
- Adds SharedBlacklist = Arc<RwLock<Blacklist>> + source_path
- Supports live reload via replace() (re-reads from source_path)
- is_blacklisted() takes a read lock (lock-free for the probe hot path)
- set_global_shared_blacklist in config.rs wires it into the manager
- 2 new unit tests cover replace() and snapshot isolation
main.rs:
- Spawns the heartbeat thread at startup (file at /var/run)
- Constructs the SharedBlacklist from the policy directory
config.rs:
- Replaces GLOBAL_BLACKLIST OnceLock<Blacklist> with
OnceLock<SharedBlacklist>; the probe hot path reads via
Arc<RwLock>, not the OnceLock directly
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v1.6 status table (64 tests)
- D5-AUDIT.md v1.6 update
- HARDWARE-VALIDATION-MATRIX.md adds heartbeat and AER rows
- AGENTS.md + docs/README.md pointers to v1.6
Test totals: 64 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 37 files.
SIGHUP trampoline for the SharedBlacklist is left for a future round;
the replace() infrastructure is in place today so an operator can
add the signal handler without changing the policy module.
Third-round integrations of the driver-manager migration's D-phase.
The pcid_interface crate (in local/sources/base submodule, see
upstream commit ddcd0870) now reads REDBEAR_DRIVER_PCI_IRQ_MODE
and REDBEAR_DRIVER_DISABLE_ACCEL at connect_default time, exposing
them as PciFunctionHandle accessors. The quirk integration is
end-to-end: driver-manager emits the env vars on spawn, pcid_interface
parses them, and the child driver reads the hints from its
PciFunctionHandle.
driver-manager (16 tests, unchanged count + 3 new for observability):
- main.rs: --list-drivers prints the config table, --dry-run
prints how many drivers would-bind/defer/blacklisted without
spawning, --export-blacklist prints the loaded blacklist.
- policy.rs: adds blacklist_module_names() iterator for export.
driver-manager v1.5 quirks.rs (created earlier at v1.4 PciQuirkFlags
work) is in the staging area and is unchanged this round.
local/scripts/driver-manager-audit-no-stubs.py:
- Drops R4 (was: 'let _ = ...' no-op detection) because Rust's
'let _ = expression' is idiomatic and not actually a stub.
- Adds R5 (stub-macro callbacks: unimplemented!/todo!/unreachable!
in callback / fn bodies) to detect dead-end fallbacks.
- Audit gate now reports 0 violations across 35 files (was 34,
pcid_interface is now in scope).
local/sources/base submodule pointer: updated to upstream commit
ddcd0870 (the pcid_interface env-var-reading commit).
Test totals: 58 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 35 files.
Base submodule bump (6db0f481): hardware-correct DesignWare engine
(disable/program/enable ordering, abort-first polling, corrected SCL
timing, recovery, validation) and proper Intel LPSS PCI bring-up.
- iwlwifi candidate tables: remove the c-prefixed iwlmld series from
the current Mini-MVM candidate lists — the MVM transport cannot
drive MLD firmware, and selecting it would fail firmware boot
instead of falling back to a compatible image (review MAJOR). c-series
returns with the MLD op-mode (Phase 6/W). Fallback TOML chains no
longer mix MLD and MVM series.
- redbear-iwlwifi + redbear-wifictl candidate detection now probes
both the flat /lib/firmware/iwlwifi-* and the post-2026
/lib/firmware/intel/iwlwifi/ layouts (review MAJOR).
- plan doc: review-fix round recorded; precision fixes — amd-mp2-i2cd
remains registration-only until its mailbox engine lands, and the
system-quirk flags parse but have no consumers until Phase 5.
Validation: iwlwifi 8 + wifictl 21 tests pass, base cooks for
x86_64-unknown-redox.
- Bump submodule/base to the acpid AML-handler hardening (bounded stall,
mutex owner-check, static _PSS/_PSD/_CST/_CPC cache, panic-free scheme
path, observability). Proven NOT a regression: a mutex-only baseline
wedges identically under load in a 3/3 framebuffer-ground-truth test,
so the residual under-load boot wedge is head-of-line blocking in
initnsmgr, not acpid.
- Add local/docs/INITNSMGR-CONCURRENCY-DESIGN.md: the concrete
worker-offload design (Design A) that decouples the blocking openat
from the initnsmgr dispatch loop, plus Design B (kernel O_NONBLOCK +
deferred single-thread), a staged plan, and validation rules. Key
finding baked in: redox_rt's Mutex is a spinlock, so the cap_fd must be
resolved under a short lock and the openat run with the lock released.
- Update INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md with the acpid
hardening section (done vs the still-deferred #1 transport decoupling).
- Add local/patches/wip-initnsmgr/step1-send-refactor.patch: the
compiled-but-not-yet-boot-validated Step 1 (Rc<RefCell> -> Arc<Mutex>
Send refactor) of initnsmgr, saved durably. It is intentionally NOT in
the base gitlink: bootstrap is the earliest-boot component and this
must be boot-validated on an idle host (the current host is under heavy
external load) before landing. Steps 2-5 (worker bring-up) likewise
need an idle host.
Round-two integrations of the driver-manager migration's D-phase.
The policy loader is now active (the redbear-driver-policy package
now actually changes spawn_decision_gate behavior at runtime), the
--concurrent=N CLI flag enables the SMP worker pool, PciQuirkFlags
is wired into actual driver spawn (env vars to the child), and the
two C0 service files have been committed in the local/sources/base
submodule. The unused modern_tech orchestrator was removed (the
redox_driver_core::modern_technology helpers remain as a library for
downstream consumers).
driver-manager (16 tests, was 13):
- config.rs: PciQuirkFlags hints are now passed to the spawned child as
env vars (REDBEAR_DRIVER_PCI_IRQ_MODE=intx_or_msi, REDBEAR_DRIVER_DISABLE_ACCEL=1).
Adds blacklist_match() consult at probe time before spawn_decision_gate.
- main.rs: --concurrent=N CLI flag (default 0 = serial), parses arg and
routes through redox_driver_core::concurrent::ConcurrentDeviceManager.
Loads /etc/driver-manager.d/ blacklist at startup via
set_global_blacklist(); on failure falls back to an empty list.
- policy.rs: new file. BlacklistFile / BlacklistEntry TOML schema,
load_dir() reads .toml/.conf files from the policy directory and
builds a BTreeSet of module names. Missing directory returns empty
(opt-in). Tests cover missing / valid / invalid-file paths.
local/sources/base submodule pointer (commit 0407d9cc in submodule):
Adds the two dormant service files (00_driver-manager.service in
init.d/ and 40_driver-manager-initfs.service in init.initfs.d/).
Both are gated by ConditionPathExists=!/etc/driver-manager.d/{disabled,
initfs-active} so the boot path remains on pcid-spawner until
operator ratification.
redox-driver-core: unchanged library. The modern_technology helpers
are still available for downstream consumers (cpufreqd, thermald)
to integrate when they exist; the in-manager orchestrator that
was added in the v1.3 round has been removed because it wrote JSON
files that nothing read.
§ 0.5 audit-no-stubs.py: 0 violations across 34 files. 52 tests pass
across the three crates.
Base submodule bump (452452e4): the I2C transfer chain was stubbed
end-to-end and is now real code — dw-i2c DesignWare engine ported from
Linux 7.1, intel-lpss-i2cd PCI discovery for ARL-H/MTL-P, i2cd provider
routing.
Config fixes for the chain:
- drivers.d spawn paths: six entries pointed at /usr/lib/drivers/ for
binaries staged at /usr/bin/ (i2cd, gpiod, dw-acpi-i2cd, intel-gpiod,
i2c-gpio-expanderd, i2c-hidd) — those drivers would never spawn.
- init services: add 00_intel-lpss-i2cd.service
(type = { scheme = "i2c-lpss" }, absolute cmd path since init PATH
covers only /usr/bin); dw-acpi-i2cd upgraded from oneshot_async to
type = { scheme = "dw-acpi-i2c" } now that it serves a scheme
forever; i2c-hidd requires_weak gains 00_intel-lpss-i2cd.service so
the touchpad adapter exists before HID probing.
Validation: base cooks for x86_64-unknown-redox; staged binary paths
verified against spawn configs; make lint-config clean.
Refs: local/docs/LG-GRAM-16Z90TP-COMPATIBILITY-PLAN.md Phase 4
Systematic audit of all 18 scheme-serving daemons for the acpid failure
class (single-threaded daemon that can wait unboundedly in its serving
thread). Findings recorded in INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md:
- acpid was the ONLY software unbounded wait in the boot-critical path
(fixed). No other boot-path handler has an unbounded software wait or a
reentrant blocking open of another scheme.
- Hardware busy-waits (rtcd/ps2d/audio/gpu register polls) are
hardware-bounded or in daemons pcid does not spawn without the device.
- ucsid is the one remaining co-victim: it reads /scheme/acpi in
build_state() before publishing its scheme and is the only blocking,
acpi-dependent boot unit in redbear-mini. It already degrades on EAGAIN
and works with acpid fixed. It must NOT be flipped to oneshot_async
(that breaks ucsi scheme registration, which init performs via the
{scheme=…} type); the correct hardening is a source refactor
(publish-then-discover), done with runtime validation, not blind.
redbear-mini now reaches a working brush login and executes commands
(framebuffer ground truth: login -> MOTD -> `user@redbear: $` ->
`echo RB=$((21*2))=OK` -> `RB=42=OK`; login ~12s, brush ~16s in QEMU
q35/KVM). This is the console-login floor of the desktop path.
Root cause was NOT in login/brush/pty/spawn (16+ prior sessions chased
those). cpufreqd reads /scheme/acpi/processor/CPUn/pss; evaluating that
AML ran `_ACQ` on an ACPI mutex whose acquire handler (a) multiplied
the millisecond timeout by 1000 (0xFFFF "wait forever" became ~18h) and
(b) tracked no owner, so a nested acquire by acpid's single AML thread
self-deadlocked. Because acpid is single-threaded and also serves the
`acpi` scheme socket, and because the single-threaded init namespace
manager does a blocking openat in its dispatch loop, a stuck acpid
froze EVERY open in the system. Fixed in submodule/base d78fd44a
(bumped here), verified against local/reference/linux-7.1 ACPICA.
Docs:
- Add local/docs/INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md: the
residual architectural root (initnsmgr head-of-line blocking + kernel
ignoring O_NONBLOCK on open) that still lets one slow daemon wedge the
whole open path, with a worker-offload / deferred-open / kernel
O_NONBLOCK execution plan. This is the answer to "use SMP where it's
justified": the parallelism that matters is fault isolation of the
namespace-open path, not throughput.
- CONSOLE-TO-KDE-DESKTOP-PLAN.md v5.9: record the mini-login result and
point at the new plan.
Note: submodule/base worktree also carries in-progress i2c/driver-manager
work (not part of this commit); the acpid fix is isolated.
Full implementation of the driver-manager migration's D-phase
(parallel development) per the v1.3 plan. The § 0.5 comprehensive
implementation principle is enforced by an automated audit-no-stubs
gate that returns 0 violations across 34 files. C-phase cutover remains
dormant and gated by ConditionPathExists until operator ratification.
redox-driver-core (28 unit + 5 integration tests):
- concurrent.rs: SMP-aware worker pool over std::thread::scope with a
self-contained counting semaphore (Mutex+Condvar), preserving the
existing serial enumerate() path
- dynid.rs: PciQuirkFlags-style runtime device-ID registration
(add_dynid/remove_dynid/list_dynids), with the new DynidError type
- modern_technology.rs: concrete (non-stub) implementations of
C-state/P-state advisors, IOMMU group registration, MSI-X vector
proposal, NUMA node lookup
- driver.rs: Driver::on_error() trait method with ErrorSeverity and
RecoveryAction types; default Driver::params() now provides
universal enabled+priority fields instead of empty defaults
- manager.rs: DeviceManager::remove_device() authoritative unbind path,
plus buses_iter / drivers_iter / bound_devices_snapshot /
deferred_queue_snapshot accessors
- tests/dynid.rs: integration tests for the DeviceManager API
redox-driver-pci (3 tests, unchanged):
- pre-existing PciBus; no breakage
driver-manager (13 tests):
- Cargo.toml: adds redox-driver-sys path dep
- quirks.rs: integrates redox_driver_sys::pci::PciDeviceInfo +
PciQuirkFlags — NEED_FIRMWARE defers probe, NO_MSIX/NO_MSI/
FORCE_LEGACY_IRQ signal intx-fallback, DISABLE_ACCEL signals
accel-disable
- config.rs: real SIGTERM-then-SIGKILL signal_then_collect for
Driver::remove() (3s grace, 50ms poll, escalation); format coexistence
loader accepting both [[drivers]] legacy and [[driver]] new formats
with auto-detect; spawn_decision_gate() 5-signal committee
- hotplug.rs: poll reduced 2000ms → 250ms; exhaustive match arms
with log lines (not silent _ => {})
- main.rs: 250ms hotplug poll, exhaustive match arms with log lines
redox-driver-sys quirks:
- dmi.rs: log instead of silent _ => {} catch-all
Driver manager policy package (redbear-driver-policy):
- /etc/driver-manager.d/00-blacklist.conf (4 driver blacklist entries)
- /etc/driver-manager.d/50-amdgpu.toml (AMD GPU driver policy)
- /etc/driver-manager.d/initfs.manifest (ordered initfs driver list)
- /etc/driver-manager.d/autoload.d/ntsync.conf (autoload ntsync module)
- /etc/driver-manager.d/README.md (explanation)
- recipe.toml: custom install script that stages into /etc/driver-manager.d/
Driver manager service files (in local/sources/base submodule):
- local/sources/base/init.d/00_driver-manager.service — dormant
(oneshot_async, ConditionPathExists=!/etc/driver-manager.d/disabled)
- local/sources/base/init.initfs.d/40_driver-manager-initfs.service —
dormant (oneshot, ConditionPathExists=!/etc/driver-manager.d/initfs-active)
Audit gate:
- local/scripts/driver-manager-audit-no-stubs.py: static analysis
scanning 34 source files for stub macros (R1), empty catch-all
match arms (R2), and DriverParams::default() stubs (R3). Returns
0 violations at v1.3.
- local/scripts/driver-manager-audit-no-stubs.sh: thin wrapper
- local/scripts/test-driver-manager-no-stubs-qemu.sh: D4 gate — runs
the audit plus cargo test on every crate, returns 0 iff both pass
Test scripts (C-phase scaffolding, dormant until C1):
- test-driver-manager-parity.sh (C1)
- test-driver-manager-active.sh (C3)
- test-driver-manager-initfs.sh (C2)
- test-driver-manager-hotplug.sh (D3)
- test-driver-manager-pm.sh (D2)
- test-driver-manager-cutover.sh (C4)
Docs:
- local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md: v1.3 status table
listing every D-phase item as Done
- local/docs/evidence/driver-manager/D5-AUDIT.md: capability-by-
capability matrix + verbatim audit output
- local/docs/HARDWARE-VALIDATION-MATRIX.md: driver-manager rows
added with v1.3 status
- local/AGENTS.md: PLANNING NOTES pointer updated to v1.3
- docs/README.md: Related Red Bear-local plans row updated to v1.3
Test totals: 49 tests across the three crates, all passing.
Audit totals: 0 violations across 34 files, all clean.
Note: local/sources/base service files (00_driver-manager.service and
40_driver-manager-initfs.service) live in a submodule and need a
separate commit there. They are NOT included in this commit.
Same latent bug class as the acmd fix (f505d18a89): both drivers used
the USB endpoint ADDRESS number (ep.address & 0x0F) as the endpoint key,
but xhcid keys endpoints by global enumeration index across all
interfaces of the selected configuration. The two coincide only when
the device's endpoint addresses are sequential in enumeration order —
devices with non-sequential addresses (some modems/audio gear) would
open the wrong endpoint or fail to open.
Both now count endpoints in configuration order per selected
configuration, matching xhcid's PortState::get_endp_desc indexing.
Verified: cargo check -Z build-std --target x86_64-unknown-redox clean
for both crates.
Bug fix: endpoint numbers were computed as per-interface positions, but
xhcid keys endpoints by GLOBAL index across all interfaces of the
configuration. On two-interface ACM devices (comm interrupt-IN first),
the driver opened (interrupt-IN, bulk-IN) as (bulk_in, bulk_out) — read
from the interrupt endpoint and wrote to the IN endpoint. Endpoints are
now counted across all interfaces in configuration order, exactly as
xhcid's PortState::get_endp_desc does.
P6-A expansion (Linux 7.1 cdc-acm.c reference):
- SEND_BREAK (0x23) control request
- SERIAL_STATE monitoring: poll the comm interface's interrupt-IN
endpoint on a dedicated thread, parse the 8-byte header + 2-byte UART
state bitmap (CDC 1.1 6.3.5): DCD/DSR/break/RI/framing/parity/overrun,
log transitions
- scheme gains a read-only 'state' file reporting the current line
state (dcd=.. dsr=.. ...) for getty/terminal consumers
Verified: cargo check -Z build-std --target x86_64-unknown-redox clean,
no new warnings. Runtime validation needs an ACM device (QEMU has no
CDC ACM emulation; FTDI/Arduino on bare metal or passed through).
Upstream xhci_calculate_lpm_timeout needs SuperSpeed endpoint companion
SEL/PEL parsing across the hub tree + tier policy + XHCI_LPM_SUPPORT
vendor quirk. Defaults-only timeout writes would be speculative and can
break device links. P7-B assigned a dedicated workstream.
Audit: set_usb2_hw_lpm is xHCI-only upstream; EHCI PM is vendor-specific
TDI PHY LPM only. Correct EHCI power path is legacy L2 port suspend
(host-agnostic); deferred until a concrete device need arises.
vasilito