From cbabf7d111db0898c123642f57d8f0f5f32bdab1 Mon Sep 17 00:00:00 2001 From: ScottW514 Date: Fri, 14 Aug 2026 17:53:57 -0400 Subject: [PATCH] BRINGUP: record audit Phase 8 - the kernel rows are complete All kernel/image fixes across the audit phases now wait on the one image build + flash; Phase 8 bench items listed. --- docs/BRINGUP.md | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/docs/BRINGUP.md b/docs/BRINGUP.md index b1976b8..ebdcd6f 100644 --- a/docs/BRINGUP.md +++ b/docs/BRINGUP.md @@ -1,10 +1,41 @@ # ForgeFIRM bring-up status & cold-start runbook -Last updated: **2026-08-14** — **audit remediation Phases 0 through 7 +Last updated: **2026-08-14** — **audit remediation Phases 0 through 8 landed** (from an independent whole-tree audit dated 2026-08-13; the remediation is sequenced behind two gates — GATE A, uncommanded energy, before any further live-fire; GATE B, control surface + release, before -any published release). +any published release). **Phase 8 completes the kernel rows: every +kernel/image fix from Phases 1, 2 (B-3), 3, 5, 6, and 8 — plus the +platform-hygiene batch and the gap-refire kernel half — is now +code-complete and waiting on the ONE image build + flash.** + +**Phase 8 (kernel-module hardening) is code-complete; rides the image +flash.** Probe: `/dev/glowforge` registers last so the error unwind can +never deregister a device userspace already opened; the unwind clears +the SDMA interrupt callback (previously dangling into devm-freed driver +data across an `-EPROBE_DEFER` cycle) and releases the state dirent +(K-7). Remove: every userspace surface comes down before the hardware — +a concurrent attribute read can no longer reach `gpio_get_value` on +freed descriptors — and the dirent is `sysfs_put`, not leaked (K-8). +The fan-tach spinlock is initialized and taken in the IRQ handler (the +cooling engine's fan verdicts ride these two 64-bit timestamps, which +tear on arm32 unlocked) (K-9); tach IRQ setup cleans up after itself +and records only actually-requested IRQs, with idempotent teardown +(K-10). The LED trigger removes its attributes before the sync timer +delete and serializes the simulation step against its store handlers +(K-15). The kernel dead-man now **halts instead of disabling** — no +40 V rail drop, so a crash recovery is never left in the exact state +that wedges the DRV8825 drivers (K-18). Bounds: the safing-path +pin-change off-by-one (K-14); `ignored_faults` capped to the documented +0–7 with the probe fault state decided on the masked value (K-16); +`PIN_LASER_ON_HEAD` joins the SDMA pin set and the stop/shutdown +change sets (K-19); the run-start no-data gate refuses the run on a +failed head fetch (K-20); PIC single-register writes reject values +above the documented 10-bit range instead of wrapping (K-21). +**Bench (on the flashed image):** module load/unload clean under +`CONFIG_DEBUG_MUTEXES`; forced `-EPROBE_DEFER` unwinds without a +dangling callback; concurrent `cat` during remove does not fault; the +Phase 1/3/5/6 kernel drills all re-run green on this one image. **Phase 6 (motion integrity) is code-complete and host-verified.** A mid-run underrun or stepper fault is no longer silently absorbed: the