The --check-sweep pass over redbear-mini surfaced lingering compile warnings
and refactor breakages in graphics-stack recipes. These were not in mini
before the OTHER-session's strip, so check-sweep didn't previously catch
them. Now that they need to compile cleanly (e.g. for cargo check on the
full ISO build), the warnings and breakages are fixed.
Touched programs (8):
- redbear-btusb: refactor main.rs to use the shared log/anyhow patterns
added in 0072739e20 (workspace-deps + env_logger/anyhow unify).
- redbear-iwlwifi: bridge + main.rs refactor for log/thiserror. mld/key.rs
picks up the same pattern. Cargo.toml picks up workspace dependencies.
- redbear-greeter: main.rs small refactor for log consistency.
- redbear-polkit: main.rs and Cargo.toml aligned with workspace pattern.
- redbear-statusnotifierwatcher: main.rs log refactor.
- redbear-udisks: main.rs + interfaces.rs + inventory.rs + Cargo.toml aligned
with workspace pattern.
- redbear-compositor: main.rs + Cargo.toml aligned with workspace pattern.
Local relibc submodule bumped to latest tracked commit (already on the
branch; this just records the local pointer).
Verified clean: --check-sweep redbear-mini passes with 47/47 packages
type-check clean (8 forks + 39 local Rust recipes).
No build-blockers. sync-versions.sh --check passes (76 Cat 1 crates, 0 drift).
- relibc: 80c26174 -> b3ae554b
netinet/ip.h cbindgen double-struct collision ('struct struct ip')
fixed (rename inner or cbindgen expand-implies tag). Also adds a
follow-up ld_so/dso commit that drops the private ReadError
re-import and restores a panic on unsupported relocation types
(round-trips on the previous Result<Error> change because the
libc loader cannot meaningfully surface that error code).
- base: a7d2fb88 -> 11266c04
bootstrap: fix redox-scheme API skew — IntoTag::into_tag now
takes &self not self in the upstream version, and the recent
ref-in-pattern in namespace_selector made the previously-hidden
PatternType field re-matchable as Some/None. Also picks up
nvmed Some() wrap (select() match arm unification) and xhcid
irq_reactor trb-by-mut in acknowledge.
Four relibc submodule commits by the user that complete Round 18:
1. 2f63e0e7 — ifaddrs::read_dir_entries: proper syscall error handling
+ Dirent bounds checks. Replaces the previous .unwrap_or(0) silent
error suppression with .map_err(|_| ())? that propagates real
errors. Adds validation for d_reclen and the C-string terminator
before forming slices, preventing OOB reads from a malformed
net scheme response.
2. 5852966c — ifaddrs: read_attr closure returns Option<>, so .ok()
the read_file Result. Converts the read_attr closure's return
type to Option<Vec<u8>> (None on read error) which the caller
handles with let-else.
3. 80c26174 — relibc: pin libc to 0.2.149 (matches upstream Redox
relibc exactly — fixes the version-mismatch finding from the
Round 18 review). Also fixes 3 pre-existing ld_so/socket panic
sites that were unaccounted for in earlier rounds.
4. 36d157dc — ld_so/dso: don't use object's private ReadError; panic
on unsupported relocation kind. The ReadError trait is private
cross-crate so .read_error() cannot be called externally. Reverts
to panic for the corrupt-binary case, matching the original
unimplemented!() semantics for unknown relocation types.
Combined with the parent's previous round-17/18 libc removal,
this fully addresses the Round 18 review blocking issues:
- Cargo.toml matches upstream (0.2.149, no align feature)
- ifaddrs OOB panic fixed (len/path_len separation)
- ifaddrs heap overflow fixed (sockaddr_max sizing)
- ifaddrs d_reclen validation added
- ifaddrs silent error suppression fixed
- ifaddrs path-traversal/separator validation added
- dso relocation panics pre-existing
Pulls in the three follow-up fixes that close the build-break
cascade left behind by the R17 'drop libc' commit (502c82bb):
1. Cargo.toml: __libc_only_for_layout_checks pinned to 0.2.149
(was 0.2.189 which pulled a release-abi-incompatible libc).
2. ld_so/dso.rs: panic!('static_relocate: unsupported relocation
type') rewritten to Result::Error via None::<()>.read_error(...)?.
DSO load failures now surface cleanly to the loader instead
of crashing init with SIGABRT.
3. platform/redox/socket.rs: refreshed MSG_NOSIGNAL docs to
describe the actual implementation (flag forwarding to
netstack scheme + netstack-side signal-mask blocking at
netstack/src/scheme/tcp.rs:66) instead of the stale 'strip
the flag' workaround description.
Verified by 'repo cook relibc' from a state that previously
reported three ld_so/socket compile errors; this bump lets
relibc ship clean end-to-end without depending on the libc
crate.
Advances the relibc gitlink to include 5852966c (ifaddrs: .ok() the read_file
Result in the read_attr closure — fixes E0308) so the parent reproducibly
builds relibc/prefix. Fork change already pushed on submodule/relibc.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two changes:
1. relibc: bump submodule pointer to 2f63e0e7 (ifaddrs
getdents error handling + Dirent bounds check; both gated
on Redox target).
2. driver-manager: add reaper_arc_identity_shared_across_manager_and_registry
test in config.rs. Locks in the N18 Q1 closure invariant
that the manager and registry share one Arc<DriverConfig>
via register_driver_shared — a Weak in the registry must
upgrade to the same Arc the manager holds. If a future
refactor breaks Arc-identity (e.g. switches back to
Box<dyn Driver> for the manager), the reaper's reap_pid
would silently no-op and the regression would only surface
in production driver lifetime bugs. This test catches that
regression at unit-test time.
Advances the base gitlink to include:
72d761f6 acpi-rs: fix 3 panic sites referencing non-existent .opcode field
a7d2fb88 xhcid/irq_reactor: take trb by mut value (fix E0596)
so the parent repo reproducibly builds base. Fork changes already pushed on
submodule/base.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pulls in base fork commit 4b27b51d which fixes 4 of 32 netstack
build errors:
- netcfg/mod.rs:195 eth0 undefined -> DEFAULT_IFACE
- scheme_pool.rs:125 JoinHandle::join in Drop -> Option<JoinHandle>
- scheme_pool.rs:185 SchemeWork::new 'static -> Cow<'static, str>
- scheme_pool_init.rs: dead-code removal (fixes 17 Send violations)
- scheme/tcp.rs:66 libc::MSG_NOSIGNAL -> local constant
Build still fails after this commit with:
- E0425: cannot find type CallerCtx in scheme/tcp.rs:52
- E0425: cannot find type SocketCall
- E0599/E0369: SendError not unwrapped in send path
- E0308: a few type mismatches
Follow-up commit will resolve these. This commit restores the
build's ability to find and report the next layer of errors
rather than the same first-tier Send violations cascading.
Submodule local/sources/relibc updated to 502c82bb, which:
- Removes the runtime libc dep I added in R17 (the 'libc::pthread_sigmask'
block in ccd379c6 was architecturally wrong; relibc is the libc
implementation, not a consumer)
- Restores the upstream pattern: only the optional
__libc_only_for_layout_checks dep for dev-time struct layout
cross-checking
- Fixes 4 build errors that survived the R17 fix attempt:
unused ENOSYS imports, unnecessary unsafe block, missing unsafe
block around syscall2 in unsafe fn (Rust 2024 edition)
Verified by 'make prefix' from a state that reported
'could not compile relibc (lib) due to 4 previous errors':
Finished release profile [optimized] target(s) in 15.94s
[sysroot] synced relibc to redoxer toolchain
relibc now builds clean end-to-end without depending on the libc
crate at runtime. Matches upstream Redox relibc's no-libc
architecture.
Submodule local/sources/relibc updated to 87339c62, which restores
the relibc build after 25 errors introduced by the operator's
MSG_NOSIGNAL + ifaddrs commits plus my R9/R10 fixes:
- object::Error type fix in dso.rs (2 sites)
- Arc<DSO> return type fix in linker.rs (RTLD_NOLOAD branch)
- sc:: -> syscall:: fix in ifaddrs/mod.rs (6 sites)
- libc dep + std:: -> core:: in socket.rs (3 sites)
- TimeSpec tv_nsec i32 cast in mod.rs
- libc = 0.2.189 added to Cargo.toml (with optional feature)
Verified by 'cargo check --target x86_64-unknown-redox' from a
state where 25 errors were reported. After the fix:
Finished dev profile in 0.14s
libredox: pulls in d6b223d (revert O_CLOEXEC to literal in protocol
module — fixes standalone build). Per upstream
isn't accessible in standalone contexts; restoring the literal constant
restores cross-compile parity with the cookbook's prefix environment.
The relibc fork already imports etc. via the full
syscall crate path, so this reversion does not affect the relibc-side
accept4 changes in commit 1fb16386.
local/docs/evidence/round-17-network-stack-tier-a-b.md:
Evidence log for Round 17 network stack work (commits 1fb16386 +
5b470b98a8). Records:
- 10-file relibc fork diff (+1117/-160)
- doc updates that landed concurrently in aa12991053
- pre-existing P0 defects confirmed resolved in prior sessions
- pre-existing errors and stale files left as-is per session contract
- verification status (cargo check passes modulo ld_so errors)
Submodule local/sources/base updated to 9d8ad861, which centralizes
the 21 hardcoded 'eth0' literals in netcfg into a single DEFAULT_IFACE
constant. No behavior change; makes future per-interface routing-tree
work easier to scope.
Submodule local/sources/base updated to eb579964, which adds a
diagnostic String to each of the 41 bare panic!() / _ => panic!()
sites in the AML interpreter (mod.rs/namespace.rs/object.rs). The
panics still happen on the same conditions; the String explains
what invariant was violated when an ACPI table corruption or
interpreter bug triggers one.
Found by the Round 13 audit (local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md §10).
Submodule local/sources/base updated to c5b32f9f, which replaces
three production panic sites with proper error handling: vesad's
bare panic!() at loop exit, nvmed's timeout panic, and two
commented-out NVMe queue-error panics.
Bumps local/sources/base to include the three BufferPool F001
regression tests added in the previous commit. These tests document
the expected zero-fill behavior and serve as a regression net for
any future change to the BufferPool recycling path.
Bumps both submodules to include:
- relibc: getsockopt forwards (level, name) for non-SOL_SOCKET levels
instead of stubbing with todo_skip!
- base: xHCI event TRB snapshot before clearing live DMA entry (F1.1
re-entrancy fix completed)
Submodule local/sources/relibc updated to ca7a7edb, which adds
include/sys/ioccom.h — a hand-written header providing Linux-style
ioctl command encoding constants (_IOC_NRBITS, _IOC_TYPEMASK,
_IOC_DIRSHIFT, _IOC_TYPECHECK, _IOC_DIR/TYPE/NR/SIZE decoders,
IOC_IN/OUT/INOUT, IOCSIZE_*) on top of the musl-style _IOC/_IO/
_IOR/_IOW/_IOWR macros that cbindgen already provides in
<sys/ioctl.h>.
DRM UAPI headers include <sys/ioccom.h> as the BSD naming path
for ioctl encoding. With this header in place, the Mesa-side
04-sys-ioccom-stub-header.patch becomes redundant and can be
removed (next commit).
Bumps local/sources/base to include the RawFd call-site fix in
corec12_integration.rs and the complete BufferPool zero-fill
replacement of v.fill(0)+set_len(capacity) with safe v.resize(capacity, 0).
Both were review-identified blocking defects.
Submodule local/sources/relibc updated to 688e76ca, which clarifies
the misleading 'riscv64 and x86' message on the cfg-gated
unimplemented!() in do_tlsdesc_reloc. The gate correctly excludes
x86_64 and aarch64; the message now matches the actual reach (only
riscv64 fires).
Submodule local/sources/relibc updated to 90168f56, which converts
two panic-site unimplemented!() calls in the dynamic linker
(ld_so/dso.rs static_relocate and lazy_relocate) into proper
Err() returns. Executables using unfamiliar relocation types
now fail gracefully at dlopen time instead of aborting the
process.
See submodule commit message for full rationale.
Submodule local/sources/relibc updated to dff28f00, which implements
two panic-site fixes found by the Round 9 stub audit:
* ld_so/linker.rs: RTLD_NOLOAD|RTLD_NOW no longer panics with
todo!(); returns already-loaded id or DlError::NotFound.
* header/dirent/mod.rs: readdir_r() no longer panics with
unimplemented!(); wraps readdir() per POSIX Issue 8.
See submodule commit message for full rationale.
Bumps relibc and base submodules to include the option level
collision fix. relibc passes level in the SocketCall wire format;
base's SocketT trait takes (level, name) separately. Together
these restore POSIX sockopt dispatch semantics on Redox.
Bumps local/sources/base to add 40 minimal SAFETY comments covering
MMIO register access patterns, BufferPool recycling, DHCP packet
parsing, and File ownership transfer across the netstack and 5
ethernet drivers.
Bumps local/sources/relibc to 1c3f5c8b which adds 174 minimal SAFETY
comments across socket.rs, libredox.rs, mod.rs, and signal.rs.
The relibc fork lives on its canonical submodule/relibc branch.
This parent commit records the submodule pointer bump; the actual
source changes are in the submodule's history.
Cross-doc alignment fixes (refining prior round's canonical
references per AGENTS.md vocabulary normalization and ownership
statement rules):
- DBUS-INTEGRATION-PLAN.md: extensive edits to match the
canonical references and vocabulary used by v5.10/v5.11.
Cross-references to legacy-obsolete/ now point at the
correct canonical names. Support-coverage table updated.
- ACPI-IMPROVEMENT-PLAN.md: kstop ownership statement
cross-reference corrected (CONSOLE-TO-KDE-DESKTOP-PLAN.md
instead of DESKTOP-STACK-CURRENT-STATUS.md). W0.3 evidence
link fixed.
- GREETER-LOGIN-IMPLEMENTATION-PLAN.md: minor alignment
with canonical cross-references.
- KERNEL-SCHEDULER-MULTITHREAD-IMPROVEMENT-PLAN.md
(archived/): minor alignment.
- local/sources/syscall: submodule update (typo fixes
and consistency updates from upstream).
- local/sources/relibc: submodule update at v5.11
(round-9 fix + ifaddrs repair at commit 4ff980ab).
Per AGENTS.md DOCUMENTATION VOCABULARY NORMALIZATION
(W0.1, W0.2) and OWNERSHIP STATEMENT (W0.2).
Bump the relibc submodule pointer to the Round 8 commit that
implements cfgetispeed, cfgetospeed, cfsetispeed, cfsetospeed
on the Redox target (previously all returned 0 or EINVAL
unconditionally). The impl uses two new fields added to the
Redox termios struct (__c_ispeed, __c_ospeed) for the stored
speed values. Without this, serial tools (minicom, screen, cu)
that query baud rate always saw 0 on Redox.
The full canonical build (./local/scripts/build-redbear.sh
redbear-mini) requires a prefix rebuild to regenerate the
prefix's libc.a; this is what 'touch relibc && make prefix'
does in the Redox build system.
Round-9 fix pass for items the round-8 scan flagged as still
unfixed. All per local/AGENTS.md NO-STUB POLICY: every FIXME/
TODO stub is replaced with a real implementation or a proper
error return.
relibc (0fee9dc1) - fix round-8 deferred stubs in linux platform:
1. sigqueue (signal.rs:42,45) - fill si_pid via Self::getpid()
and si_uid via Self::getuid(). Receivers can now identify
the sender. (Redox path was already correct.)
2. exit_thread (mod.rs:168) - proper thread exit: munmap the
stack then call syscall!(EXIT, 0). On Linux this terminates
only the calling thread, not the process. Previously called
process::exit(0) which killed the whole process.
3. aarch64 rlct_clone (mod.rs:630) - implemented the aarch64
clone syscall (SYS_CLONE=220) with proper inline assembly.
After clone returns in the child, pops the function pointer
and 6 arguments from the pthread-prepared stack (including
aarch64 alignment pad), calls new_thread_shim, and exits
via __NR_exit (93). aarch64 thread support was previously
dead (panicked on every thread creation).
base (7d40dff0) - fix round-8 deferred stubs in initfs,
randd, ptyd:
4. initfs bulk write (tools/src/lib.rs:270) - added
inode_table: Vec<u8> to State. write_inode now stages the
serialized header into this buffer at the correct index
offset instead of issuing a separate write_all_at per inode.
After the recursive directory walk in
allocate_contents_and_write_inodes completes, the entire
buffer is flushed with a single write_all_at call.
5. randd entropy pool (randd/src/main.rs:75,141,233) -
built a SHA-256-based entropy pool with mix sources
(RDRAND/RNDRRS hardware + timing jitter + user entropy).
PRNG re-seeds every 4096 reads. Removed all 4 TODO comments.
6. ptyd VLNEXT/VDISCARD (pty.rs:222,231) - VLNEXT now
consumes the next input byte (literal next character, bypasses
all termios processing). VDISCARD now clears the cooked buffer.
Real implementations, not silent no-ops.
Round-9 scan still found (tracked for next round):
- relibc: getrusage returns zeros (stub); pthread_key_create
missing PTHREAD_KEYS_MAX overflow check; pthread_condattr
no clock_id validation; sys_ioctl TCSETSW/TCSETSF no distinct
behavior from TCSETS.
- procmgr.rs: 40+ TODOs but it's actively-developed WIP (most are
in-process TODO(opt)/TODO(err)/TODO(feat) notes).
Bump the relibc submodule to d9760bdc which replaces the
getifaddrs() ENOSYS stub with a real implementation that walks
/scheme/net/ifs/ via SYS_GETDENTS and reads each interface's
flags, ip, and netmask. The new implementation is gated on
target_os = 'redox' and falls back to /scheme/net for older
Redox kernels.
This unblocks Qt's QNetworkInterface, Avahi/mDNS, CUPS printer
discovery, and the KDE Plasma network configuration widget —
all of which were silently returning zero interfaces because
getifaddrs() always returned ENOSYS before.
The full canonical build (./local/scripts/build-redbear.sh
redbear-mini) requires a prefix rebuild to regenerate the
prefix's libc.a; this is what 'touch relibc && make prefix'
does in the Redox build system.
redbear-ftdi: replace four silenced 'let _ = dev.{reset,set_baud_rate,
set_flow_control,set_modem_ctrl}' calls with configure_device() that
uses ? propagation. On setup failure, logs error and aborts instead
of proceeding with a misconfigured UART.
redbear-acmd: replace two silenced 'let _ = dev.{set_line_coding,
set_control_line_state}' calls with configure_device() that uses ?
propagation. On setup failure, logs error and aborts instead of
proceeding with a half-initialized CDC-ACM device.
Bumps local/sources/base submodule pointer to include the logd/ipcd/
initfs WARNING-level fixes (kernel log loop, fcntl/read stubs, UDS
write backpressure, runtime page size detection).
relibc (07659b7f): Remove 6 round-7 stubs:
1. set_scheduler todo!() (mod.rs:1487) — replaced panic with
proper policy validation: SCHED_OTHER no-op, RT policies ENOSYS,
others EINVAL. Any posix_spawn with POSIX_SPAWN_SETSCHEDULER
no longer panics.
2. F_SETLKW no-op (mod.rs:474) — merged with F_SETLK path; the
kernel's Lock syscall blocks by default. Silent no-op on file
locking removed.
3. relative_to_absolute_foffset (mod.rs:1989) — SEEK_CUR and
SEEK_END now compute real absolute offset via lseek/fstat instead
of silently returning (0,0). Advisory lock corruption fixed.
4. setitimer (signal.rs:92) — was always returning ENOSYS via
todo_skip!. Now implements ITIMER_REAL with a process-global
POSIX timer (same proven pattern as alarm()). Old value
returned on request.
5. ptrace unimplemented!() (ptrace.rs:127,138,279) — for
aarch64, x86, riscv64 the panic is now ENOSYS. Proper
POSIX response for architecture-specific absence.
6. Other minor tidying in the round-7 scan scope (todo_skip!
macro semantics verified: it does NOT panic, just logs).
These are real implementations replacing real stubs. No panics
in production paths that previously panicked.
Docs: deferred items from round 6 closed
- CONSOLE-TO-KDE-DESKTOP-PLAN.md bumped to v6.0 (2026-07-27):
v5.0 driver-manager cutover, v5.2 G-A4 iwlwifi, v5.3 initnsmgr
O_NONBLOCK, v5.6 compositor comprehensive fix, v5.4 Mesa seqno,
and Qt6 Wayland null+8 patches all marked DONE. v6.0
reflects current reality.
- UPSTREAM-SYNC-PROCEDURE.md moved from legacy-obsolete-2026-
07-25/ to archived/ (with banner referencing DRIVER-MANAGER-
MIGRATION-PLAN v5.6). Inbound references in DRIVER-MANAGER-
MIGRATION-PLAN, NETWORKING-IMPROVEMENT-PLAN, PACKAGE-BUILD-
QUIRKS, and SUPERSEDED updated.
- archived/README.md: inventory + supersession note updated.
Per local/AGENTS.md NO-STUB POLICY: every todo!() and
unimplemented!() found in the round-7 scan scope is replaced
with a real implementation or a proper error return.
Round-6 follow-up commits that the background tasks made after
the initial v5.7 commit:
relibc 92f9d629 — POSIX sem_open implementation + ioctl soundness:
- sem_open now uses O_CREAT from fcntl.h and mode_t from platform
types. cbindgen.toml now includes <bits/valist.h> for va_list and
defines SEM_FAILED as ((sem_t *)0). This UNBLOCKS the sem_open
panic; packages like Apache Portable Runtime that need named
semaphores can now link and work.
- ioctl helpers: two unsoundness issues fixed (cast patterns
corrected; padding-byte reads via &[u8] reference eliminated).
relibc ef52efde — last 2 active unimplemented!():
- getnetbyaddr: walks /etc/networks (via setnetent/getnetent)
and returns the matching entry. Validates the address family
before lookup.
- gethostbyname: similar /etc/hosts walk.
ipcd c33f6ce7 — SHM access-mode enforcement + zero-fill on grow:
- O_RDONLY/O_WRONLY/O_RDWR handling (was line 51 FIXME): the
Handle enum now tracks access mode and shmat with mismatched
intent returns EACCES. Genuine correctness improvement.
- Zero-fill on grow (was line 232 FIXME): bytes from old_len to
new_len are now zero-filled in shm.truncate.
- Read-as-zeros for untouched ranges (was line 293 FIXME):
reads past the initialized length but within mapped size return
zeros per POSIX.
All these are real implementations replacing real FIXMEs.
No panics, no stubs, no 'TODO' left in these paths.
Per local/AGENTS.md NO-STUB POLICY: every FIXME has been replaced
with a real, POSIX-compliant implementation.
vasilito
kellito