Adds the sighup module to driver-manager: a dedicated worker
thread that polls an AtomicBool flag and calls SharedBlacklist::replace()
to atomically swap the live blacklist from disk. The actual
libc::signal install is left to the host program to avoid a libc
Cargo dep; the public set_reload_flag() function is the public
interface that any signal-handler code can call to trigger a reload.
sighup.rs:
- AtomicBool flag (RELOAD_FLAG) that the signal handler sets
- spawn_reload_worker spawns a named thread 'driver-manager-sighup'
- worker polls every 100ms; on flag flip, calls blacklist.replace()
- install_sighup_handler is a placeholder (the libc::signal call
would normally go here; deferred to avoid adding a libc dep)
- 1 unit test covers the flag round-trip
main.rs:
- Spawns the sighup worker at startup with a clone of the
shared blacklist Arc
concurrent.rs:
- Trivial whitespace-only change from earlier round
(DriverMatch type cleanup)
Test totals: 67 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 38 files.
Docs: DRIVER-MANAGER-MIGRATION-PLAN.md v1.7 header + status table;
D5-AUDIT.md v1.7; HARDWARE-VALIDATION-MATRIX.md adds SIGHUP row;
AGENTS.md + docs/README.md pointers to v1.7.
Fourth-round integrations of the driver-manager migration's D-phase.
Three new modules in driver-manager: heartbeat, aer, plus a
SharedBlacklist wrapper around the existing Blacklist that supports
live reload.
heartbeat.rs:
- Heartbeat struct with a publishing thread that writes a JSON
status line to /var/run/driver-manager.heartbeat.json every 5s
- Tracks bound / deferred / spawned / unbound / on_error counters
- 3 unit tests cover counter updates, JSON output, and clone semantics
aer.rs:
- AER (PCI Express Advanced Error Reporting) listener thread
- Reads /scheme/acpi/aer for events (parses severity + device bdf)
- Routes to bound driver via scheme:driver-manager lookup
- Returns RecoveryAction (Handled / ResetDevice / RescanBus) based
on severity
- Falls back to log-and-no-op when /scheme/acpi is absent
- 7 unit tests cover parsing, routing, and severity mapping
policy.rs:
- Adds SharedBlacklist = Arc<RwLock<Blacklist>> + source_path
- Supports live reload via replace() (re-reads from source_path)
- is_blacklisted() takes a read lock (lock-free for the probe hot path)
- set_global_shared_blacklist in config.rs wires it into the manager
- 2 new unit tests cover replace() and snapshot isolation
main.rs:
- Spawns the heartbeat thread at startup (file at /var/run)
- Constructs the SharedBlacklist from the policy directory
config.rs:
- Replaces GLOBAL_BLACKLIST OnceLock<Blacklist> with
OnceLock<SharedBlacklist>; the probe hot path reads via
Arc<RwLock>, not the OnceLock directly
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v1.6 status table (64 tests)
- D5-AUDIT.md v1.6 update
- HARDWARE-VALIDATION-MATRIX.md adds heartbeat and AER rows
- AGENTS.md + docs/README.md pointers to v1.6
Test totals: 64 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 37 files.
SIGHUP trampoline for the SharedBlacklist is left for a future round;
the replace() infrastructure is in place today so an operator can
add the signal handler without changing the policy module.
Third-round integrations of the driver-manager migration's D-phase.
The pcid_interface crate (in local/sources/base submodule, see
upstream commit ddcd0870) now reads REDBEAR_DRIVER_PCI_IRQ_MODE
and REDBEAR_DRIVER_DISABLE_ACCEL at connect_default time, exposing
them as PciFunctionHandle accessors. The quirk integration is
end-to-end: driver-manager emits the env vars on spawn, pcid_interface
parses them, and the child driver reads the hints from its
PciFunctionHandle.
driver-manager (16 tests, unchanged count + 3 new for observability):
- main.rs: --list-drivers prints the config table, --dry-run
prints how many drivers would-bind/defer/blacklisted without
spawning, --export-blacklist prints the loaded blacklist.
- policy.rs: adds blacklist_module_names() iterator for export.
driver-manager v1.5 quirks.rs (created earlier at v1.4 PciQuirkFlags
work) is in the staging area and is unchanged this round.
local/scripts/driver-manager-audit-no-stubs.py:
- Drops R4 (was: 'let _ = ...' no-op detection) because Rust's
'let _ = expression' is idiomatic and not actually a stub.
- Adds R5 (stub-macro callbacks: unimplemented!/todo!/unreachable!
in callback / fn bodies) to detect dead-end fallbacks.
- Audit gate now reports 0 violations across 35 files (was 34,
pcid_interface is now in scope).
local/sources/base submodule pointer: updated to upstream commit
ddcd0870 (the pcid_interface env-var-reading commit).
Test totals: 58 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 35 files.
Base submodule bump (6db0f481): hardware-correct DesignWare engine
(disable/program/enable ordering, abort-first polling, corrected SCL
timing, recovery, validation) and proper Intel LPSS PCI bring-up.
- iwlwifi candidate tables: remove the c-prefixed iwlmld series from
the current Mini-MVM candidate lists — the MVM transport cannot
drive MLD firmware, and selecting it would fail firmware boot
instead of falling back to a compatible image (review MAJOR). c-series
returns with the MLD op-mode (Phase 6/W). Fallback TOML chains no
longer mix MLD and MVM series.
- redbear-iwlwifi + redbear-wifictl candidate detection now probes
both the flat /lib/firmware/iwlwifi-* and the post-2026
/lib/firmware/intel/iwlwifi/ layouts (review MAJOR).
- plan doc: review-fix round recorded; precision fixes — amd-mp2-i2cd
remains registration-only until its mailbox engine lands, and the
system-quirk flags parse but have no consumers until Phase 5.
Validation: iwlwifi 8 + wifictl 21 tests pass, base cooks for
x86_64-unknown-redox.
Round-two integrations of the driver-manager migration's D-phase.
The policy loader is now active (the redbear-driver-policy package
now actually changes spawn_decision_gate behavior at runtime), the
--concurrent=N CLI flag enables the SMP worker pool, PciQuirkFlags
is wired into actual driver spawn (env vars to the child), and the
two C0 service files have been committed in the local/sources/base
submodule. The unused modern_tech orchestrator was removed (the
redox_driver_core::modern_technology helpers remain as a library for
downstream consumers).
driver-manager (16 tests, was 13):
- config.rs: PciQuirkFlags hints are now passed to the spawned child as
env vars (REDBEAR_DRIVER_PCI_IRQ_MODE=intx_or_msi, REDBEAR_DRIVER_DISABLE_ACCEL=1).
Adds blacklist_match() consult at probe time before spawn_decision_gate.
- main.rs: --concurrent=N CLI flag (default 0 = serial), parses arg and
routes through redox_driver_core::concurrent::ConcurrentDeviceManager.
Loads /etc/driver-manager.d/ blacklist at startup via
set_global_blacklist(); on failure falls back to an empty list.
- policy.rs: new file. BlacklistFile / BlacklistEntry TOML schema,
load_dir() reads .toml/.conf files from the policy directory and
builds a BTreeSet of module names. Missing directory returns empty
(opt-in). Tests cover missing / valid / invalid-file paths.
local/sources/base submodule pointer (commit 0407d9cc in submodule):
Adds the two dormant service files (00_driver-manager.service in
init.d/ and 40_driver-manager-initfs.service in init.initfs.d/).
Both are gated by ConditionPathExists=!/etc/driver-manager.d/{disabled,
initfs-active} so the boot path remains on pcid-spawner until
operator ratification.
redox-driver-core: unchanged library. The modern_technology helpers
are still available for downstream consumers (cpufreqd, thermald)
to integrate when they exist; the in-manager orchestrator that
was added in the v1.3 round has been removed because it wrote JSON
files that nothing read.
§ 0.5 audit-no-stubs.py: 0 violations across 34 files. 52 tests pass
across the three crates.
Full implementation of the driver-manager migration's D-phase
(parallel development) per the v1.3 plan. The § 0.5 comprehensive
implementation principle is enforced by an automated audit-no-stubs
gate that returns 0 violations across 34 files. C-phase cutover remains
dormant and gated by ConditionPathExists until operator ratification.
redox-driver-core (28 unit + 5 integration tests):
- concurrent.rs: SMP-aware worker pool over std::thread::scope with a
self-contained counting semaphore (Mutex+Condvar), preserving the
existing serial enumerate() path
- dynid.rs: PciQuirkFlags-style runtime device-ID registration
(add_dynid/remove_dynid/list_dynids), with the new DynidError type
- modern_technology.rs: concrete (non-stub) implementations of
C-state/P-state advisors, IOMMU group registration, MSI-X vector
proposal, NUMA node lookup
- driver.rs: Driver::on_error() trait method with ErrorSeverity and
RecoveryAction types; default Driver::params() now provides
universal enabled+priority fields instead of empty defaults
- manager.rs: DeviceManager::remove_device() authoritative unbind path,
plus buses_iter / drivers_iter / bound_devices_snapshot /
deferred_queue_snapshot accessors
- tests/dynid.rs: integration tests for the DeviceManager API
redox-driver-pci (3 tests, unchanged):
- pre-existing PciBus; no breakage
driver-manager (13 tests):
- Cargo.toml: adds redox-driver-sys path dep
- quirks.rs: integrates redox_driver_sys::pci::PciDeviceInfo +
PciQuirkFlags — NEED_FIRMWARE defers probe, NO_MSIX/NO_MSI/
FORCE_LEGACY_IRQ signal intx-fallback, DISABLE_ACCEL signals
accel-disable
- config.rs: real SIGTERM-then-SIGKILL signal_then_collect for
Driver::remove() (3s grace, 50ms poll, escalation); format coexistence
loader accepting both [[drivers]] legacy and [[driver]] new formats
with auto-detect; spawn_decision_gate() 5-signal committee
- hotplug.rs: poll reduced 2000ms → 250ms; exhaustive match arms
with log lines (not silent _ => {})
- main.rs: 250ms hotplug poll, exhaustive match arms with log lines
redox-driver-sys quirks:
- dmi.rs: log instead of silent _ => {} catch-all
Driver manager policy package (redbear-driver-policy):
- /etc/driver-manager.d/00-blacklist.conf (4 driver blacklist entries)
- /etc/driver-manager.d/50-amdgpu.toml (AMD GPU driver policy)
- /etc/driver-manager.d/initfs.manifest (ordered initfs driver list)
- /etc/driver-manager.d/autoload.d/ntsync.conf (autoload ntsync module)
- /etc/driver-manager.d/README.md (explanation)
- recipe.toml: custom install script that stages into /etc/driver-manager.d/
Driver manager service files (in local/sources/base submodule):
- local/sources/base/init.d/00_driver-manager.service — dormant
(oneshot_async, ConditionPathExists=!/etc/driver-manager.d/disabled)
- local/sources/base/init.initfs.d/40_driver-manager-initfs.service —
dormant (oneshot, ConditionPathExists=!/etc/driver-manager.d/initfs-active)
Audit gate:
- local/scripts/driver-manager-audit-no-stubs.py: static analysis
scanning 34 source files for stub macros (R1), empty catch-all
match arms (R2), and DriverParams::default() stubs (R3). Returns
0 violations at v1.3.
- local/scripts/driver-manager-audit-no-stubs.sh: thin wrapper
- local/scripts/test-driver-manager-no-stubs-qemu.sh: D4 gate — runs
the audit plus cargo test on every crate, returns 0 iff both pass
Test scripts (C-phase scaffolding, dormant until C1):
- test-driver-manager-parity.sh (C1)
- test-driver-manager-active.sh (C3)
- test-driver-manager-initfs.sh (C2)
- test-driver-manager-hotplug.sh (D3)
- test-driver-manager-pm.sh (D2)
- test-driver-manager-cutover.sh (C4)
Docs:
- local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md: v1.3 status table
listing every D-phase item as Done
- local/docs/evidence/driver-manager/D5-AUDIT.md: capability-by-
capability matrix + verbatim audit output
- local/docs/HARDWARE-VALIDATION-MATRIX.md: driver-manager rows
added with v1.3 status
- local/AGENTS.md: PLANNING NOTES pointer updated to v1.3
- docs/README.md: Related Red Bear-local plans row updated to v1.3
Test totals: 49 tests across the three crates, all passing.
Audit totals: 0 violations across 34 files, all clean.
Note: local/sources/base service files (00_driver-manager.service and
40_driver-manager-initfs.service) live in a submodule and need a
separate commit there. They are NOT included in this commit.
Same latent bug class as the acmd fix (f505d18a89): both drivers used
the USB endpoint ADDRESS number (ep.address & 0x0F) as the endpoint key,
but xhcid keys endpoints by global enumeration index across all
interfaces of the selected configuration. The two coincide only when
the device's endpoint addresses are sequential in enumeration order —
devices with non-sequential addresses (some modems/audio gear) would
open the wrong endpoint or fail to open.
Both now count endpoints in configuration order per selected
configuration, matching xhcid's PortState::get_endp_desc indexing.
Verified: cargo check -Z build-std --target x86_64-unknown-redox clean
for both crates.
Bug fix: endpoint numbers were computed as per-interface positions, but
xhcid keys endpoints by GLOBAL index across all interfaces of the
configuration. On two-interface ACM devices (comm interrupt-IN first),
the driver opened (interrupt-IN, bulk-IN) as (bulk_in, bulk_out) — read
from the interrupt endpoint and wrote to the IN endpoint. Endpoints are
now counted across all interfaces in configuration order, exactly as
xhcid's PortState::get_endp_desc does.
P6-A expansion (Linux 7.1 cdc-acm.c reference):
- SEND_BREAK (0x23) control request
- SERIAL_STATE monitoring: poll the comm interface's interrupt-IN
endpoint on a dedicated thread, parse the 8-byte header + 2-byte UART
state bitmap (CDC 1.1 6.3.5): DCD/DSR/break/RI/framing/parity/overrun,
log transitions
- scheme gains a read-only 'state' file reporting the current line
state (dcd=.. dsr=.. ...) for getty/terminal consumers
Verified: cargo check -Z build-std --target x86_64-unknown-redox clean,
no new warnings. Runtime validation needs an ACM device (QEMU has no
CDC ACM emulation; FTDI/Arduino on bare metal or passed through).
Runtime log output is user-visible system surface; cross-references to
other operating systems belong in code comments and commit messages
(per project convention), not in runtime logs. The debounce parameters
and the comment-level references stay unchanged.
Track base 01200174 (smolnetd empty-router/broadcast warnings silenced, e1000e
82574 NIC support). redbear-sessiond: suppress the harmless first dbus connect
retry so it does not print an alarming line on every boot.
Track relibc submodule pointer 733da068 (translate POSIX F_DUPFD_CLOEXEC 1030 to
Redox syscall value 5, so OwnedFd::try_clone and thus tokio Runtime::build stop
failing with EINVAL). Also revert the ineffective epoll_ctl retry.
Remove temporary tokio/sessiond EINVAL diagnostics now that the root cause is
fixed.
relibc is statically linked into every userspace binary, so a relibc change
invalidates every consumer, not just the 4 initfs-critical packages the old
ABI_CRITICAL_PKGS list covered. A stale consumer silently bakes in old relibc
behaviour; diagnosing against such stale binaries wastes enormous time. Now:
if relibc rebuilds, ALL package pkgars + recipe build trees are invalidated
for a clean relink; otherwise any consumer pkgar older than relibc.pkgar (the
interrupted-build skew that shipped a broken login image) is invalidated.
Also add a temporary SESSIOND_DIAG probe that tries each tokio runtime config
and logs which one EINVALs, to pinpoint the tokio-runtime failure.
Comprehensive fix — not a fallback. Each recipe now has explicit
[package] section with name and version. Version inference:
- Git-source recipes without rev/branch: '0.1.0' (Red Bear convention)
- Tar/git recipes with version in URL or dir name: extracted version
- Sysroot-copy recipes: matched to toolchain version
Affected: 250+ recipes across all categories (core, libs, dev, system,
kde, qt, drivers, gpu, drm, kernel, userspace, etc.) Every recipe
in the redbear-mini build chain that was missing [package] now has
explicit version metadata. Cookbook can now always determine a version
at packaging time, eliminating 'cannot guess version' failures.
No cookbook fallback hack — the source of truth is recipe metadata.
Bootloader fork rebase:
- Base changed from 0.1.0 pre-patched archive to upstream 1.0.0 tag (c7eeb9f)
- Applied 0001-redbear-local-forks.patch (Cargo.toml crate path redirects)
- Applied fix-uefi-alloc-panic.patch equivalents (4 panic!() -> graceful
error handling in src/main.rs)
- Applied P5-live-preload-cap-1gib.patch (1 GiB cap on live image preload)
- Skipped: P0 GPT partition scan (requires new module + integration),
P1 timeout/default-resolution, P2 live preload guard (subsumed by
panic fixes + cap), P3 live image safe read, P4 large ISO boot,
redox.patch — to be applied in dedicated rebase session.
firmware-loader/Cargo.toml: version 0.1.0 -> 0.3.0 (sync with other
Red Bear custom crates which are at 0.3.0).
fork-upstream-map.toml: bootloader back from PENDING_REBASE to 1.0.0
since the partial rebase matches upstream 1.0.0 content.
fork-upstream-map.toml: base restored to 'main' tracked (was correctly
tracked by build-redbear.sh).
- Implement krealloc in linux-kpi memory.rs with GFP-aware tracker lookup,
copying, and zeroing of grown regions; add krealloc declaration to slab.h
- Align __GFP_ZERO/__GFP_NOWARN and GFP_* values between linux-kpi/slab.h
and redox_glue.h; make __GFP_ZERO a meaningful flag bit
- Add missing POSIX/errno base constants (EFBIG, EISDIR, ESPIPE, etc.) to
linux-kpi linux/errno.h so firmware-size checks and other drivers compile
- Harden linux-kpi bug.h: BUG()/BUG_ON() abort, WARN_ON_ONCE only warns once,
BUILD_BUG_ON uses _Static_assert
- Harden redox_glue.h: add PCI_COMMAND_* flags, CONFIG_HZ/HZ, jiffies
conversion macros, once-only WARN_ON_ONCE, _Static_assert BUILD_BUG_ON
- Implement redox_pci_enable_device/redox_pci_set_master with real local state
and command-bit updates; document pcid-spawner pre-enable
- Remove realloc-only krealloc from redox_stubs.c; it now links from linux-kpi
- Fix wait_for_completion_timeout to interpret timeout as jiffies and convert
to milliseconds, and update msecs/usecs_to_jiffies to use HZ
- Stage previously completed firmware-loader path deps and constructor fix
- Stage base and relibc submodule pointer updates from prior work
Replace version-string deps on redox_syscall, redox-scheme, and
libredox with path dependencies pointing to local/sources/ forks.
This aligns with local/AGENTS.md local-fork-dependency rule and
eliminates the crates.io vs local fork ambiguity that causes
mismatched-type link errors.
Replace ad-hoc struct literals scattered across the source with
named constructor methods (CacheMetadata::placeholder, CacheMetadata::from_source,
FirmwareFallback::load_defaults, FirmwareFallback::load_from_dir,
FirmwareFallback::builtins). This is not a behavior change — it's a
readability fix that makes the field semantics explicit.
Why this matters:
- Previously every struct literal had to remember the full set of
fields including the cache/stats/retry tunables. Adding a new field
required finding every literal in the source tree.
- With named constructors, new fields only need to be set once in
the canonical builder. Test/placeholder sites stay minimal.
- Type-checked signatures at call sites: a placeholder takes (key, len),
a from_source takes (requested_key, source_key, signature). The
compiler now verifies you pass a SourceSignature when you need one.
Cross-referenced with Linux drivers/base/firmware_loader.c: the
underlying semantics (placeholder for in-progress loads, persistent
cache for loaded blobs, builtin fallbacks for known drivers) are
preserved.
Previously: host_redox_stubs returned ENOSYS for all syscalls except
close/munmap/get_euid/ruid/egid/rgid — silent failures when IOMMU
code was tested on the host.
Now (host only):
- open/read/write/close → real libc file I/O
- mmap → real libc memory allocation (MAP_ANON|MAP_PRIVATE)
- munmap → real libc munmap
- clock_gettime → real libc CLOCK_REALTIME
- fstat → real libc fstat
- fsync/fdatasync/ftruncate → real libc ops
- getpid/getuid/geteuid/getgid/getegid → real libc
- strerror → real libc strerror (not hardcoded message)
- 12 remaining unsupported ops: ENOSYS with same semantics
(dup, signals, waitpid, namespaces — not needed for IOMMU tests)
Systemic fix: all local recipes (~150 references across 40+ Cargo.toml files)
now resolve libredox, redox_syscall, and redox-scheme through
recipes/core/base/ symlinks instead of local/sources/ paths.
Eliminates lockfile collision between Cargo's resolution of the same
package through different path strings (local/sources/ vs recipes/core/base/).
This is required because the base recipe's workspace Cargo.toml resolves
these deps through recipes/core/base/ (via symlink chain from the
recipe copy location), and Cargo treats different path strings to the
same directory as different packages.
The previous tokio = { features = ["full"] } pulled in tokio::signal
(including tokio::signal::unix::SignalKind::terminate). On Redox the
libc signal-handler registration path is incomplete; calling
enable_all() in main triggered a protection fault inside relibc, and
the kernel then panicked on unreachable code in
process::exit_this_context (see kernel/src/syscall/process.rs:79).
Two-part fix:
- Cargo.toml: scope tokio features to rt, rt-multi-thread, macros,
net, time, sync. This drops and , which are
unavailable on Redox anyway. The init system manages the daemon
lifecycle, so a signal handler is not needed in this daemon.
- src/main.rs: spawn_signal_handler becomes a no-op. The shutdown_tx
channel is preserved for any future internal shutdown signaling.
The SIGTERM path is removed entirely.
This unblocks Phase 2.1 by removing the kernel panic cascade: the
protection fault no longer fires, the kernel's exit_this_context
reaches the context switch cleanly, and the previous
unreachable!() panic no longer triggers.
Cross-compile error: from_bits_truncate requires u8 but
O_STAT/O_RDWR are usize. Cast with 'as u8'.
Applied to all 4 scheme wrappers: acmd, ftdi, ecmd, usbaudiod.
vasilito