Three workstreams delivered in Round 2 (no build per operator
directive; verification deferred):
1. Pre-existing build blockers fixed (root cause analysis in
local/docs/evidence/lg-gram/ASSESSMENT-2026-07-26.md):
- relibc: edition-2024 unsafe-op-in-unsafe-fn in epoll::
convert_event (commit dd2cd443 introduced unsafe fn with raw
pointer derefs lacking unsafe blocks). Fix in submodule/relibc
commit b80f8b47 wraps each deref in unsafe { } with SAFETY
justification; outer unsafe fn signature preserved.
- base: acpid Cargo.toml 'common' path bug. acpid lives at
drivers/acpid/ (depth 2 in base workspace) but declared
common = { path = "../../common" } (2 ..) which resolves to
base/common/ — a path that has never existed. All 8 other
depth-2 crates correctly use ../common. The build script's
overlay-integrity auto-repair normally papers over this; it
failed during Round 1 verification. Fix in submodule/base
commit 28e356d5 makes acpid consistent with siblings.
2. Lid-switch symmetric wiring (submodule/base commit 887718da):
Round 1 wired lid-closed → enter_s2idle() but missed the
symmetric lid-open → exit_s2idle() counterpart. Without it,
the system stays in 'wake devices armed' state when MWAIT
never engaged. Round 2 makes the wiring symmetric. The
userspace-driven wake path coexists with the kernel MWAIT-
return path (kstop reason=2); the double-call is safe per
ACPI 6.5 §3.5.3 (_WAK/_SST idempotent in working state).
3. Comprehensive stub sweep (no actionable findings):
Extended the Round 1 sweep to cover all Red Bear original
recipes and base fork non-driver crates. Zero unimplemented!()/
todo!() macros in Red Bear original code. Remaining 'stubs' are
either documented dead code (lookup_hid_quirks + HidQuirkFlags
— 5-flag type defined, no consumer) or empty-by-design tables
with real loader shape (PLATFORM_RULES, DMI_ACPI_QUIRK_RULES —
documented in Round 1). No new stubs replaced.
Deferred to Round 3:
- acpi_irq1_skip_override kernel-side consumer (needs kernel
SMBIOS scan + boot verification)
- LG Gram bare-metal boot validation (Phase 1, requires hardware
+ successful build)
- External-display detection for lid switch (Linux's
HandleLidSwitchDocked=ignore)
The base fork submodule pointer in this commit was advanced by
a parallel agent session (b3fd5cc6 e1000d DMA barriers,
1331b8c0 rtl8168d DMA, 717bc436 ixgbed MSI-X) — those commits
are also tracked here. The relibc fork pointer advances to
b80f8b47 (my unsafe-block fix).
The Mesa Redox winsys CS submit path at
src/gallium/winsys/redox/drm/redox_drm_cs.c:156 faked the seqno with
'result.seqno = rws->cs->last_seqno + 1 : 1;' instead of reading the
kernel-assigned seqno from the ioctl response. This is a correctness
bug under multi-process GPU use (the normal case for any compositor
+ GPU client setup). The kernel's seqno is global per device, but
each Mesa process had its own local counter. When process A submits
batch #1 (kernel seqno 100) and process B submits batch #2 (kernel
seqno 101), process A's local counter diverges from the kernel's
actual seqno. Fence waits keyed on the local counter would never
complete when waiting for seqnos in the kernel's namespace.
Fix (three coordinated changes):
### 1. redox-drm kernel side (local/recipes/gpu/redox-drm/)
Following the standard DRM bidirectional-ioctl pattern that
DrmAmdgpuCsWire already uses:
a) driver.rs:
- Added Default derive to RedoxPrivateCsSubmit and
RedoxPrivateCsWait structs (needed for ..Default::default() at
construction sites).
- Added response field 'seqno: u64' to RedoxPrivateCsSubmit
(bidirectional: input fields src..byte_count, output seqno).
- Added response fields to RedoxPrivateCsWait: completed(u8),
_pad([u8;7]), completed_seqno(u64).
- Updated size tests: Submit 32->40 bytes, Wait 16->32 bytes.
- Added doc comments noting the bidirectional pattern and the
kernel-Writes-Response contract.
b) scheme.rs:
- CS_SUBMIT handler writes resp.seqno back into req.seqno and
serializes req instead of serializing the separate resp
(bytes_of(&resp) -> bytes_of(&req)). This is the kernel
returning the response in the same struct.
- CS_WAIT handler similarly copies result fields into req.
- req made mutable for in-place mutation before serialization.
- All other places that construct these structs use
..Default::default() for the new response fields.
c) drivers/amd/mod.rs, intel/mod.rs, virtio/mod.rs:
- Each cs_submit and cs_wait construction site now uses
..Default::default() for the new response fields. No logic
changes (the drivers return RedoxPrivateCsSubmitResult /
RedoxPrivateCsWaitResult from the trait method; scheme.rs
copies the response into the bidirectional struct).
### 2. Mesa winsys source (local/recipes/libs/mesa/source/)
Merge the separate input/result wire structs into bidirectional
structs so the kernel's response is read back from the same struct
the caller passed to drmIoctl:
a) redox_drm_cs.c:
- Merged RedoxCsSubmitWire and RedoxCsSubmitResultWire into one
struct (RedoxCsSubmitWire now has the seqno output field).
- Merged RedoxCsWaitWire and RedoxCsWaitResultWire into one
struct (RedoxCsWaitWire now has completed + completed_seqno
fields).
- Removed 'result.seqno = rws->cs->last_seqno + 1 : 1;' fake.
Instead, reads 'submit.seqno' and 'wait.completed_seqno' from
the same struct after drmIoctl returns.
- Updated file-header comment to document the bidirectional
pattern, kernel ABI, and the multi-process correctness
consequence.
b) Patches the durability:
- Added 'mesa/26-cs-submit-bidirectional-seqno.patch' to the
patches list in local/recipes/libs/mesa/recipe.toml.
- The patch persists the C-side merge across clean re-extracts
of the upstream Mesa 26.1.4 tarball.
Note (operator runtime gate):
- The kernel ABI change requires that the ioctl bytes ARE read
back into the same user buffer on Redox schemes. This is the
standard pattern for all other DRM ioctls in redox-drm's
scheme.rs (DrmGemCreateWire, DrmAmdgpuCsWire, DrmCreateDumbWire
etc.). Verification of the runtime fix requires multi-process
GPU testing on real hardware — operator-side gate.
- Per AGENTS.md NO-FALLBACK policy: this fixes a real correctness
bug. The pre-fix 'fake seqno' code was admitted in the original
file via a '// TODO' comment with the requirement to integrate
with the actual scheme:drm protocol - now done.
Files changed:
- local/recipes/gpu/redox-drm/source/src/driver.rs
- local/recipes/gpu/redox-drm/source/src/scheme.rs
- local/recipes/gpu/redox-drm/source/src/drivers/amd/mod.rs
- local/recipes/gpu/redox-drm/source/src/drivers/intel/mod.rs
- local/recipes/gpu/redox-drm/source/src/drivers/virtio/mod.rs
- local/recipes/libs/mesa/source/src/gallium/winsys/redox/drm/redox_drm_cs.c
- local/recipes/libs/mesa/recipe.toml
- local/patches/mesa/26-cs-submit-bidirectional-seqno.patch
Round 1 of the LG Gram 16Z90TP compatibility work. Two parallel
workstreams in one commit:
1. Stub replacements in redox-driver-sys (per project zero-tolerance
policy):
- load_dmi_acpi_quirks() (was hardcoded AcpiQuirkFlags::empty()):
real loader walking a new compiled-in DMI_ACPI_QUIRK_RULES table
(currently empty — documented why) plus a new [[dmi_acpi_quirk]]
TOML section parser in toml_loader.rs. The full 16-flag
ACPI_FLAG_NAMES mapping is added so TOML entries can use any
AcpiQuirkFlags variant by name.
- PANEL_ORIENTATION_TABLE (was empty placeholder): populated with
10 real entries ported from Linux 7.x
drivers/gpu/drm/drm_panel_orientation.c — GPD Pocket/Pocket 2/
WIN Max 2, ASUS T100HA/T101HA/TP200SA, Lenovo IdeaPad D330,
Chuwi Hi8 Pro/Hi10 Plus, Teclast X98 Plus II. Each entry cites
its Linux source commit.
- PLATFORM_RULES (kept empty): documented why intentionally empty
(Linux platform-wide DMI quirks are pre-2020 platform workarounds
not needed by Red Bear's modern targets).
2. Broken reference fixes after the 2026-07-25 archive
(commit 589a1044e6 moved 9 docs to legacy-obsolete-2026-07-25/
but didn't update references). 30+ files referenced the moved
docs by their old local/docs/<name>.md path. This commit updates
every reference to point at local/docs/legacy-obsolete-2026-07-25/
<name>.md so links work again. Files touched: AGENTS.md,
README.md, docs/{AGENTS,README,07-RED-BEAR-OS-IMPLEMENTATION-PLAN}.md,
local/AGENTS.md, 14 docs under local/docs/, local/patches/README.md,
5 scripts under local/scripts/.
The matching acpid+ps2d consumer wiring landed earlier today in
submodule/base commit 45452c5a (force_s2idle, no_legacy_pm1b,
kbd_deactivate_fixup). The bootstrap reference fix is submodule/base
commit 263a41a9. Both are tracked by the updated submodule pointer
in this commit.
Build verification: redox-driver-sys 80 cargo tests pass. acpid/ps2d
host tests not runnable (require cross-compile). Canonical build
attempts uncovered two pre-existing failures unrelated to Round 1:
relibc edition-2024 unsafe-block issue in crtn, and the base fork's
'common' path resolution relies on the build script's overlay
integrity auto-repair which is currently failing. Neither is in code
touched by Round 1.
See local/docs/evidence/lg-gram/ASSESSMENT-2026-07-26.md for the full
round-by-round assessment and next-round plan.
Updates the parent RedBear-OS repo's gitlink pointers for the
`local/sources/kernel` and `local/sources/base` submodules to
the v5.3 commits:
- kernel: f5baa05d (scheme: honor O_NONBLOCK on open opcode)
Adds O_NONBLOCK handling to UserInner::call_inner for
Opcode::OpenAt. When a caller passes O_NONBLOCK and the
provider has not yet responded, return EAGAIN instead of
blocking the caller. This is the kernel side of Design B
from INITNSMGR-CONCURRENCY-DESIGN.md.
- base: 8c7f6172 (initnsmgr event-driven deferred retry on
O_NONBLOCK). The initnsmgr now uses O_NONBLOCK on openat to
provider daemons and parks requests on EAGAIN instead of
blocking the entire request loop. Companions with the kernel
change.
Both submodule commits already pushed to their respective
branches. This commit just updates the parent repo's gitlink
references so the build system picks them up.
No code changes in this commit - gitlink pointers only.
Three runtime-grade bugs fixed (G-A1, G-A3, G-A5 from
DRIVER-MANAGER-MIGRATION-PLAN v4.8):
G-A1: aer.rs/pciehp.rs used stable_hash() + last_seen: u64 with
'key > last_seen' deduplication. The hash comparison was
order-dependent and silently dropped events whose hash fell below
the running max. Replaced with monotonic AtomicU64 seq counter
issued by pcid. seq > last_seq is order-independent.
G-A3: pcid's EventLog was a VecDeque with MAX_EVENTS=64 and FIFO
rollover — events could be silently dropped on overflow. Increased
to MAX_EVENTS=256. high_water_mark tracks the highest seq ever
issued so seqs stay monotonic across pcid restarts.
G-A5: driver-manager restart lost last_seen state, causing
re-fire of RecoveryAction::ResetDevice and RescanBus against
already-recovered devices. Added persistent seq state at
/var/run/driver-manager/event-seqs.json with atomic temp-file
write pattern (rename is atomic on POSIX). Throttled to once per
5s. Skipped in initfs mode (path doesn't exist there).
pcid changes (committed to submodule/base as d98330a7):
- events.rs: AtomicU64 seq counter, MAX_EVENTS=256, latest_seq()
- scheme.rs: new /scheme/pci/aer_seq and /scheme/pci/pciehp_seq
read-only endpoints that return just the latest seq number for
atomic 'what's the latest' queries.
driver-manager changes (committed here):
- aer.rs: parse seq=<n>: prefix, drop stable_hash entirely
- pciehp.rs: same seq-based parsing, drop stable_hash
- unified_events.rs: load/save event-seqs.json (atomic, throttled,
initfs-safe)
Tests: 88 pass (was 72; +16 new tests for seq parsing, persistence
round-trip, throttling, initfs skip).
Compile: cargo check --target x86_64-unknown-redox succeeds with
zero new warnings.
Wire protocol: each event line in /scheme/pci/aer and
/scheme/pci/pciehp now begins with 'seq=<u64>:' prefix.
Documented in producer (pcid events.rs module doc) and consumer
(aer.rs/pciehp.rs parse_seq_prefix docstrings) sides.
Per local/AGENTS.md:
- No new branches (submodule/base is existing)
- No stubs, no todo!/unimplemented!
- pcid: Cat 2 fork, changes on submodule/base branch
- driver-manager: Cat 1 in-house, source IS the durable location
Closes v5.0 of the v5.x work program.
The dhcpd in the base submodule no longer calls connect() to the
broadcast address on its UDP socket — connect()'s source-filter
rejected OFFERs from off-broadcast DHCP servers (QEMU SLIRP at
10.0.2.2, etc.), leaving the system without an IP at login.
Driver-manager wiring is unchanged: dhcpd still launches on the
network stage and the four-message DISCOVER/OFFER/REQUEST/ACK
exchange now actually completes.
- AER listener path moves from /scheme/acpi/aer (no producer) to
/scheme/pci/aer (pcid's new producer, submodule bump 5a43628d).
- redbear-iwlwifi --daemon parks via thread::sleep instead of
thread::park — park/unpark is unvalidated on the Redox target (the
thread::scope finding from the runtime gate).
Point evdevd at /scheme/input/consumer_raw (the new raw device tap added in
base bd5e3db3) instead of /scheme/input/consumer. The console consumer handed
evdevd keymapped, VT-gated events — it only received input while its own VT
was active, and the character had already been keymapped, both wrong for a
libinput/xkbcommon (Wayland) feed. The raw tap delivers the pre-keymap event
stream for every device event regardless of the active VT, matching the Linux
evdev contract.
evdevd only ever used scancode+pressed (never character), so no translation
change is needed on its side.
Bumps the base submodule pointer to include the consumer_raw tap. Part of the
Linux-aligned input-stack consolidation
(local/docs/INPUT-STACK-LINUX-ALIGNMENT-PLAN.md). Compile-checked for
x86_64-unknown-redox.
00_base.target, 10_evdevd, 10_smolnetd, 30_redox-drm retargeted to
driver-manager services; stale dormant-era comments updated. Eliminates
'init: unit 00_pcid-spawner.service not found' from the boot log.
Repairs the broken initialize_namespace that 0c11c2b5 captured (unterminated
comment) and lands the connect_op_regions() function. Base compiles again;
_REG opregion connect is now fully wired (acpi-rs function + acpid call).
NOTE: aml/mod.rs still has a broken initialize_namespace from 0c11c2b5
(parallel session captured an intermediate edit via git add -A; their
repeated git reset on base is reverting my concurrent fix before it can
be committed). acpi.rs connect_op_regions() call is in; the acpi-rs
connect_op_regions() function + initialize_namespace repair still needs
to land once base edits stop being reset.
- base-initfs recipe: pcid-spawner removed from initfs BINS and the
lib/pcid.d initfs staging dropped (dead pcid-spawner config).
- acid.toml, redoxer.toml: requires_weak now points at
00_driver-manager.service.
- redbear-mini.toml: dead /etc/pcid.d/* staging removed; driver-manager
service override no longer gated on the retired fallback flag.
- redbear-full.toml: dead legacy-format /etc/pcid.d/ihdgd.toml and
virtio-gpud.toml removed (driver-manager's 30-graphics.toml covers
the same drivers in the current format).
- Comments updated: no fallback exists; driver-manager owns the path
unconditionally. Base submodule bump (0c11c2b5).
- base bump (b0e76065): pcid PCI 3.0 fallback no longer panics on
extended config reads (returns 0xFFFFFFFF, drops writes).
- redox-driver-pci PciBus reads only the 64-byte standard header it
consumes (vendor/device/class/subsystem), instead of the whole 4 KiB
config file per device per poll cycle — safe on MCFG-less machines
and cheaper everywhere.
Operator-ratified cutover (the D5/C-phase gate):
- redbear-device-services.toml: driver-manager added to [packages]
(was 'intentionally not included'); /lib/drivers.d/70-wifi.toml
staged (redbear-iwlwifi --daemon); stale pre-cutover comments
replaced with the single-spawner invariant for driver-manager.
- redbear-mini.toml: /etc/init.d override now stages
00_driver-manager.service (--hotplug, gated !disabled) instead of
00_pcid-spawner.service; all requires_weak references switched to
00_driver-manager.service.
- redbear-full.toml, redbear-greeter-services.toml: same requires_weak
switch for iommu, greeter, SDDM.
- base submodule bump (c72d4247): init.d/init.initfs.d service gates —
pcid-spawner services start only when
/etc/driver-manager.d/disabled exists (operator fallback, never
deleted); driver-manager services run by default.
make lint-config: OK — no init service path violations.
init now supports systemd-style ConditionPathExists (with ! negation)
in service files, and the C0 driver-manager service file has correct
polarity. The C0 dormancy is now by design (condition gate) instead of
by parser rejection accident.
Also: btusb firmware download command sequence + plan doc updates.
- btintel.rs extended: firmware_download_commands() generates the
full HCI command sequence for SFI firmware download (CSS header +
PKey + Signature + payload fragments). RSA and ECDSA header types
supported. secure_send_commands() splits data into 252-byte
fragments with type prefix. extract_boot_param() finds the
CMD_WRITE_BOOT_PARAMS record in firmware data. 5 new unit tests
(160 total pass).
- acpid/scheme.rs: ThermalZone handle kind for per-zone ACPI thermal
data. /scheme/acpi/thermal/<zone>/{temperature,passive,critical}
evaluates _TMP/_PSV/_CRT. thermald can now read real thresholds.
- Plan doc: Phase 7.1 updated with download command sequence.
ACPICA assessment updated with thermal zone methods.
Bumps base to include the pcid guard (out-of-range PCIe config offsets
return the no-response pattern / no-op instead of aborting pcid) plus
all the operator's ACPI-runtime, i2c, and ided work already on the
submodule branch. This unblocks boot past the previous pcid Invalid
opcode fault, through switchroot and the /usr driver set.
Also carries the earlier accidental commit of the initnsmgr Step 1
Send refactor (Rc<RefCell<Namespace>> -> Arc<sync::Mutex<Namespace>>),
now VALIDATED: a low-load boot progressed through all initfs units,
switchroot, and the /usr drivers via the Arc<Mutex> namespace manager
(hundreds of opens) with no regression. The residual under-load
head-of-line wedge is the known single-threaded initnsmgr issue tracked
in local/docs/INITNSMGR-CONCURRENCY-DESIGN.md (worker-offload / Design B).
Also update LG Gram plan doc: ACPICA assessment (port algorithms,
not the C library), pcid assessment (correct, no changes needed),
Phase 9.1 marked partial (LPIT + _PRW + S0-idle done; MWAIT loop
remains), status updated to reflect completed phases.
Third-round integrations of the driver-manager migration's D-phase.
The pcid_interface crate (in local/sources/base submodule, see
upstream commit ddcd0870) now reads REDBEAR_DRIVER_PCI_IRQ_MODE
and REDBEAR_DRIVER_DISABLE_ACCEL at connect_default time, exposing
them as PciFunctionHandle accessors. The quirk integration is
end-to-end: driver-manager emits the env vars on spawn, pcid_interface
parses them, and the child driver reads the hints from its
PciFunctionHandle.
driver-manager (16 tests, unchanged count + 3 new for observability):
- main.rs: --list-drivers prints the config table, --dry-run
prints how many drivers would-bind/defer/blacklisted without
spawning, --export-blacklist prints the loaded blacklist.
- policy.rs: adds blacklist_module_names() iterator for export.
driver-manager v1.5 quirks.rs (created earlier at v1.4 PciQuirkFlags
work) is in the staging area and is unchanged this round.
local/scripts/driver-manager-audit-no-stubs.py:
- Drops R4 (was: 'let _ = ...' no-op detection) because Rust's
'let _ = expression' is idiomatic and not actually a stub.
- Adds R5 (stub-macro callbacks: unimplemented!/todo!/unreachable!
in callback / fn bodies) to detect dead-end fallbacks.
- Audit gate now reports 0 violations across 35 files (was 34,
pcid_interface is now in scope).
local/sources/base submodule pointer: updated to upstream commit
ddcd0870 (the pcid_interface env-var-reading commit).
Test totals: 58 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 35 files.
Base submodule bump (6db0f481): hardware-correct DesignWare engine
(disable/program/enable ordering, abort-first polling, corrected SCL
timing, recovery, validation) and proper Intel LPSS PCI bring-up.
- iwlwifi candidate tables: remove the c-prefixed iwlmld series from
the current Mini-MVM candidate lists — the MVM transport cannot
drive MLD firmware, and selecting it would fail firmware boot
instead of falling back to a compatible image (review MAJOR). c-series
returns with the MLD op-mode (Phase 6/W). Fallback TOML chains no
longer mix MLD and MVM series.
- redbear-iwlwifi + redbear-wifictl candidate detection now probes
both the flat /lib/firmware/iwlwifi-* and the post-2026
/lib/firmware/intel/iwlwifi/ layouts (review MAJOR).
- plan doc: review-fix round recorded; precision fixes — amd-mp2-i2cd
remains registration-only until its mailbox engine lands, and the
system-quirk flags parse but have no consumers until Phase 5.
Validation: iwlwifi 8 + wifictl 21 tests pass, base cooks for
x86_64-unknown-redox.
- Bump submodule/base to the acpid AML-handler hardening (bounded stall,
mutex owner-check, static _PSS/_PSD/_CST/_CPC cache, panic-free scheme
path, observability). Proven NOT a regression: a mutex-only baseline
wedges identically under load in a 3/3 framebuffer-ground-truth test,
so the residual under-load boot wedge is head-of-line blocking in
initnsmgr, not acpid.
- Add local/docs/INITNSMGR-CONCURRENCY-DESIGN.md: the concrete
worker-offload design (Design A) that decouples the blocking openat
from the initnsmgr dispatch loop, plus Design B (kernel O_NONBLOCK +
deferred single-thread), a staged plan, and validation rules. Key
finding baked in: redox_rt's Mutex is a spinlock, so the cap_fd must be
resolved under a short lock and the openat run with the lock released.
- Update INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md with the acpid
hardening section (done vs the still-deferred #1 transport decoupling).
- Add local/patches/wip-initnsmgr/step1-send-refactor.patch: the
compiled-but-not-yet-boot-validated Step 1 (Rc<RefCell> -> Arc<Mutex>
Send refactor) of initnsmgr, saved durably. It is intentionally NOT in
the base gitlink: bootstrap is the earliest-boot component and this
must be boot-validated on an idle host (the current host is under heavy
external load) before landing. Steps 2-5 (worker bring-up) likewise
need an idle host.
Round-two integrations of the driver-manager migration's D-phase.
The policy loader is now active (the redbear-driver-policy package
now actually changes spawn_decision_gate behavior at runtime), the
--concurrent=N CLI flag enables the SMP worker pool, PciQuirkFlags
is wired into actual driver spawn (env vars to the child), and the
two C0 service files have been committed in the local/sources/base
submodule. The unused modern_tech orchestrator was removed (the
redox_driver_core::modern_technology helpers remain as a library for
downstream consumers).
driver-manager (16 tests, was 13):
- config.rs: PciQuirkFlags hints are now passed to the spawned child as
env vars (REDBEAR_DRIVER_PCI_IRQ_MODE=intx_or_msi, REDBEAR_DRIVER_DISABLE_ACCEL=1).
Adds blacklist_match() consult at probe time before spawn_decision_gate.
- main.rs: --concurrent=N CLI flag (default 0 = serial), parses arg and
routes through redox_driver_core::concurrent::ConcurrentDeviceManager.
Loads /etc/driver-manager.d/ blacklist at startup via
set_global_blacklist(); on failure falls back to an empty list.
- policy.rs: new file. BlacklistFile / BlacklistEntry TOML schema,
load_dir() reads .toml/.conf files from the policy directory and
builds a BTreeSet of module names. Missing directory returns empty
(opt-in). Tests cover missing / valid / invalid-file paths.
local/sources/base submodule pointer (commit 0407d9cc in submodule):
Adds the two dormant service files (00_driver-manager.service in
init.d/ and 40_driver-manager-initfs.service in init.initfs.d/).
Both are gated by ConditionPathExists=!/etc/driver-manager.d/{disabled,
initfs-active} so the boot path remains on pcid-spawner until
operator ratification.
redox-driver-core: unchanged library. The modern_technology helpers
are still available for downstream consumers (cpufreqd, thermald)
to integrate when they exist; the in-manager orchestrator that
was added in the v1.3 round has been removed because it wrote JSON
files that nothing read.
§ 0.5 audit-no-stubs.py: 0 violations across 34 files. 52 tests pass
across the three crates.
Base submodule bump (452452e4): the I2C transfer chain was stubbed
end-to-end and is now real code — dw-i2c DesignWare engine ported from
Linux 7.1, intel-lpss-i2cd PCI discovery for ARL-H/MTL-P, i2cd provider
routing.
Config fixes for the chain:
- drivers.d spawn paths: six entries pointed at /usr/lib/drivers/ for
binaries staged at /usr/bin/ (i2cd, gpiod, dw-acpi-i2cd, intel-gpiod,
i2c-gpio-expanderd, i2c-hidd) — those drivers would never spawn.
- init services: add 00_intel-lpss-i2cd.service
(type = { scheme = "i2c-lpss" }, absolute cmd path since init PATH
covers only /usr/bin); dw-acpi-i2cd upgraded from oneshot_async to
type = { scheme = "dw-acpi-i2c" } now that it serves a scheme
forever; i2c-hidd requires_weak gains 00_intel-lpss-i2cd.service so
the touchpad adapter exists before HID probing.
Validation: base cooks for x86_64-unknown-redox; staged binary paths
verified against spawn configs; make lint-config clean.
Refs: local/docs/LG-GRAM-16Z90TP-COMPATIBILITY-PLAN.md Phase 4
redbear-mini now reaches a working brush login and executes commands
(framebuffer ground truth: login -> MOTD -> `user@redbear: $` ->
`echo RB=$((21*2))=OK` -> `RB=42=OK`; login ~12s, brush ~16s in QEMU
q35/KVM). This is the console-login floor of the desktop path.
Root cause was NOT in login/brush/pty/spawn (16+ prior sessions chased
those). cpufreqd reads /scheme/acpi/processor/CPUn/pss; evaluating that
AML ran `_ACQ` on an ACPI mutex whose acquire handler (a) multiplied
the millisecond timeout by 1000 (0xFFFF "wait forever" became ~18h) and
(b) tracked no owner, so a nested acquire by acpid's single AML thread
self-deadlocked. Because acpid is single-threaded and also serves the
`acpi` scheme socket, and because the single-threaded init namespace
manager does a blocking openat in its dispatch loop, a stuck acpid
froze EVERY open in the system. Fixed in submodule/base d78fd44a
(bumped here), verified against local/reference/linux-7.1 ACPICA.
Docs:
- Add local/docs/INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md: the
residual architectural root (initnsmgr head-of-line blocking + kernel
ignoring O_NONBLOCK on open) that still lets one slow daemon wedge the
whole open path, with a worker-offload / deferred-open / kernel
O_NONBLOCK execution plan. This is the answer to "use SMP where it's
justified": the parallelism that matters is fault isolation of the
namespace-open path, not throughput.
- CONSOLE-TO-KDE-DESKTOP-PLAN.md v5.9: record the mini-login result and
point at the new plan.
Note: submodule/base worktree also carries in-progress i2c/driver-manager
work (not part of this commit); the acpid fix is isolated.
base -> 2a3b0d4e: per-device USB 2.0 hardware LPM (L1) enablement at
attach in xhcid (full Linux xhci.c:4650 gate chain, BESL/HIRD params,
MEL Evaluate Context, PORTHLPMC/PORTPMSC sequence). Plan P7-A updated:
xhcid side done; ehcid USBCMD.HIRD and hardware L1 validation remain.
Bump base fork to 28afc1fe:
- ad40fffd ahcid: always re-arm the IRQ line, even for foreign interrupts
(from the UAS workstream)
- 92924224 e1000d/ihdad/vboxd/xhcid: unconditional ack
- 28afc1fe sb16d/ac97d/rtl8139d/rtl8168d/ixgbed/ihdgd: unconditional ack
- 54e89a33 fbcond: perform the display handoff open off the console loop
(concurrent session's root-cause fix for the '-vga std' boot freeze)
Bug class: kernel masks the IRQ line on delivery and only re-arms on the
userspace write-back; conditional acks wedged shared INTx lines forever.
Explains a class of 'works in QEMU, wedges on real hardware' failures.
Full audit + unaffected-driver rationale recorded in the IRQ plan P3
section.
base -> fb421083:
- fbcond: retry handoff while display driver is not ready (bounded
250x10ms; fixes the 2026-07-20 '-vga std' boot freeze at 'Performing
handoff' where a transient not-ready driver left the framebuffer VT
permanently blank)
- xhcid/virtio-netd: info-level IRQ/MSI-X delivery and reactor startup
milestones for runtime-proof observability
- usb: demote diagnostic ATTACH/HUBFLOW traces to debug!
- usbhubd: gate port-indicator SetPortFeature on hub capability
userutils -> 3b02e0b9:
- getty: harden the console<->PTY bridge against transient
read/write/event errors (log-and-continue instead of panic; a panic
here killed the live shell's I/O)
The kernel fork (submodule/kernel bd1b251f) now provides a proper
'install' target honoring DESTDIR, so the recipe no longer hand-rolls
the staging copy. Fork also gains post-merge compile fixes (import
dedup + UnmapVec).
Track base pointer to bd379e07 (usbhubd debounce/reset-wait/U0-wait/
wHubDelay + SET_ISOCH_DELAY, HubDescriptorV3 device_removable fix).
USB-IMPLEMENTATION-PLAN.md: P3-A marked CORE COMPLETE with the full
Linux equivalence inventory and documented follow-ups (USB 2.0 bitmaps,
SS.Inactive warm-reset loop, multi-TT, hub LPM). Hub gap-table row
updated (249 -> ~700 LoC with Linux state machine).
HARDWARE-VALIDATION-MATRIX.md: hub row updated — enumeration core
complete with 14 unit tests; runtime hub proof tracked under P8-B.
vasilito
kellito