# Hardware Validation Matrix — Red Bear OS

| Component | QEMU | Bare Metal | Notes |
|-----------|------|------------|-------|
| **Storage** | | | |
| AHCI SATA | ✅ | 🔲 | NCQ structure present, not runtime-validated |
| NVMe | 🔲 | 🔲 | Basic driver, no multiqueue |
| virtio-blk | ✅ | N/A | QEMU only |
| **Network** | | | |
| e1000 | 🔲 | 🔲 | ITR structure present, no offload validation |
| rtl8168 | 🔲 | 🔲 | PHY config present, not runtime-tested |
| virtio-net | ✅ | N/A | QEMU only |
| **Audio** | | | |
| Intel HDA | 🔲 | 🔲 | Codec detection + jack sense added, not validated |
| AC97 | 🔲 | 🔲 | Basic driver |
| **Input** | | | |
| PS/2 | ✅ | 🔲 | QEMU keyboard/mouse work |
| USB HID | ✅ | 🔲 | Keyboard/mouse autospawn via test-usb-qemu.sh (P1 hardening); not validated on real HW |
| **USB** | | | |
| xHCI host controller | ✅ | 🔲 | Interrupt-driven mode proven (test-xhci-irq-qemu.sh); 51-flag quirk table + HCCPARAMS2 gating (P2-A/B); 36-code error recovery (P2-C); not HW-validated |
| EHCI/UHCI/OHCI controllers | 🔲 | 🔲 | Compile clean; runtime enumeration proofs planned (P8-B) |
| USB storage (BOT) | ✅ | 🔲 | usbscsid autospawn + bounded sector readback proven (test-usb-storage-qemu.sh); guest-side write verify open |
| USB hub (non-root) | ✅ | 🔲 | Hub + hub-child enumeration proven in QEMU (test-usb-hub-qemu.sh): hub descriptor/EP1/scan/debounce/reset→enable, and usb-kbd behind hub enumerates to HID subdriver (class 3.1 keyboard); "reactor race" root-caused to startup latency under load (not a deadlock) |
| **GPU/Display** | | | |
| VESA | ✅ | 🔲 | QEMU framebuffer works |
| virtio-gpu | ✅ | N/A | 2D only, QEMU |
| **CPU/Power** | | | |
| cpufreqd | 🔲 | 🔲 | Governors implemented, not HW-validated |
| thermald | 🔲 | 🔲 | ACPI thermal zones, not HW-validated |
| **SMP** | | | |
| x2APIC/SMP | ✅ | ✅ | Multi-core works |
| **Driver Manager (driver-manager vs pcid-spawner)** | | | |
| D1 P0 capabilities (C1 dynids + C2 remove + C3 enable + C4 BAR) | ✅ | 🔲 | Code complete; 52 tests pass; see `local/docs/evidence/driver-manager/D5-AUDIT.md` |
| D1 P1 SpawnDecision + format coexistence + policy blacklist | ✅ | 🔲 | `spawn_decision_gate()` consults env/CLI/blacklist; `convert_legacy` reads legacy pcid.d format |
| D1 P1 PciQuirkFlags wired into spawn | ✅ | 🔲 | `driver-manager/src/quirks.rs` consumes `redox-driver-sys`; NEED_FIRMWARE defers probe; NO_MSIX/NO_MSI/FORCE_LEGACY_IRQ signal intx-fallback via env; DISABLE_ACCEL signals accel-disable |
| D1 P1 `/etc/driver-manager.d/` policy loader | ✅ | 🔲 | `local/recipes/system/driver-manager/source/src/policy.rs`; reads TOML blacklist; consulted at probe |
| D2 SMP concurrent probe (worker pool over `std::thread::scope`) | ✅ | 🔲 | `redox-driver-core/src/concurrent.rs` with `CountingSemaphore`; tested on host; opt-in via `--concurrent=N` |
| D2 PM hooks (Driver::suspend/resume + signal_then_collect) | ✅ | 🔲 | Real SIGTERM/SIGKILL in `DriverConfig`; needs iommu/pcid SetPowerState wiring for actual D3 |
| D2 AER foundation (Driver::on_error + ErrorSeverity + RecoveryAction) | ✅ | 🔲 | Trait API complete; needs pcid AER wake source |
| D2 C-state / P-state / IOMMU / MSI-X / NUMA helpers | ✅ Library | 🔲 HW | `redox-driver-core/src/modern_technology.rs` — concrete implementations; no driver-manager wrapper (orchestrator removed at v1.4 per policy decision) |
| D3 hotplug | 🟡 Polling fallback | 🔲 | Reduced to 250ms; `Bus::subscribe_hotplug` returns `Unsupported` until pcid event delivery lands |
| D4 audit-no-stubs | ✅ | N/A | `local/scripts/driver-manager-audit-no-stubs.py` scans 38 files; **0 violations** at v1.7 |
| D4 SIGHUP reload worker | ✅ | N/A | `driver-manager/src/sighup.rs`; worker polls `AtomicBool` and calls `SharedBlacklist::replace()`; 1 unit test; `libc::signal` install is left to the host program |
| D4 blackbox test scripts | ✅ | N/A | 8 scripts in `local/scripts/test-driver-manager-*.sh` |
| D4 heartbeat publisher | ✅ | N/A | `driver-manager/src/heartbeat.rs`; writes JSON to `/var/run/driver-manager.heartbeat.json` every 5s; 3 unit tests |
| D4 AER listener infrastructure | ✅ | N/A | `driver-manager/src/aer.rs`; polls `/scheme/acpi/aer`; 7 unit tests; falls back to log-and-no-op when scheme is absent |
| C0 dormant service files | ✅ | N/A | Committed in `local/sources/base` submodule (commit `0407d9cc`); both `ConditionPathExists`-gated |
| D5 feature-complete gate | ✅ Code | 🔲 HW | All code + tests pass; awaiting real-hardware validation on AMD Threadripper + Intel Alder Lake |

✅ = validated  🔲 = implemented, not validated  N/A = not applicable

### Status note (2026-07-20)

- The login-based QEMU proofs (PS/2 + serio, monotonic timer, IOMMU first-use, USB storage BOT)
  now run through `local/scripts/qemu-login-expect.py` (stdlib python) instead of the host
  `expect` tool — no external dependency, per-step timeouts, and safe retry on premature QEMU
  death. See `local/docs/IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md` § "Runtime proof
  status (2026-07-20)".
- MSI-X (virtio-net) and xHCI interrupt-driven mode were re-confirmed on the current
  `redbear-mini` ISO — once more on 2026-07-20 ~09:10 JST via `test-lowlevel-controllers-qemu.sh`
  (log-grep legs, unaffected by host contention).
- Re-confirmation of the login-based legs (PS/2, timer, BOT) with the new
  harness is pending an uncontended host — the current build host runs a parallel QEMU-testing
  workload (a concurrent agent session under `~/.claude/jobs/` with its own QMP-controlled
  guest) that SIGKILLs competing QEMU processes; boots reach getty but the
  login prompt is not observed within the timeout there. The ✅ marks above reflect prior
  validation of those legs. A retry loop (`/tmp/opencode/a2-retry.sh`) is armed to run the
  PS/2, timer, and USB-storage legs automatically once the foreign QEMU workload exits.
- The IOMMU first-use leg currently skips on `redbear-mini` runs because
  `build/x86_64/redbear-full/harddrive.img` is absent — a `redbear-full` build is required
  to re-confirm that leg.
- Display boots (`-vga std`) can freeze at the fbcond `Performing handoff` step (the
  `reopen_for_handoff()` path can block rather than return `EAGAIN` for retry). Headless
  (`-vga none`) boots avoid it. Tracked separately on the graphics stack.