vh/forgefirm
1
0
Fork 0
mirror of https://github.com/openglow-org/forgefirm.git synced 2026-09-27 16:51:12 -07:00
Code Issues Packages Projects Releases Wiki Activity

BRINGUP: record audit Phase 8 - the kernel rows are complete

Browse Source 
All kernel/image fixes across the audit phases now wait on the one
image build + flash; Phase 8 bench items listed.
This commit is contained in:
ScottW514
2026-08-14 17:53:57 -04:00
parent 341c6399a0
commit cbabf7d111
1 changed files with 33 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/BRINGUP.md
+33 -2
View File
@@ -1,10 +1,41 @@
# ForgeFIRM bring-up status & cold-start runbook # ForgeFIRM bring-up status & cold-start runbook
Last updated: **2026-08-14** — **audit remediation Phases 0 through 7 Last updated: **2026-08-14** — **audit remediation Phases 0 through 8
landed** (from an independent whole-tree audit dated 2026-08-13; the landed** (from an independent whole-tree audit dated 2026-08-13; the
remediation is sequenced behind two gates — GATE A, uncommanded energy, remediation is sequenced behind two gates — GATE A, uncommanded energy,
before any further live-fire; GATE B, control surface + release, before before any further live-fire; GATE B, control surface + release, before
any published release). any published release). **Phase 8 completes the kernel rows: every
kernel/image fix from Phases 1, 2 (B-3), 3, 5, 6, and 8 — plus the
platform-hygiene batch and the gap-refire kernel half — is now
code-complete and waiting on the ONE image build + flash.**
**Phase 8 (kernel-module hardening) is code-complete; rides the image
flash.** Probe: `/dev/glowforge` registers last so the error unwind can
never deregister a device userspace already opened; the unwind clears
the SDMA interrupt callback (previously dangling into devm-freed driver
data across an `-EPROBE_DEFER` cycle) and releases the state dirent
(K-7). Remove: every userspace surface comes down before the hardware —
a concurrent attribute read can no longer reach `gpio_get_value` on
freed descriptors — and the dirent is `sysfs_put`, not leaked (K-8).
The fan-tach spinlock is initialized and taken in the IRQ handler (the
cooling engine's fan verdicts ride these two 64-bit timestamps, which
tear on arm32 unlocked) (K-9); tach IRQ setup cleans up after itself
and records only actually-requested IRQs, with idempotent teardown
(K-10). The LED trigger removes its attributes before the sync timer
delete and serializes the simulation step against its store handlers
(K-15). The kernel dead-man now **halts instead of disabling** — no
40 V rail drop, so a crash recovery is never left in the exact state
that wedges the DRV8825 drivers (K-18). Bounds: the safing-path
pin-change off-by-one (K-14); `ignored_faults` capped to the documented
0–7 with the probe fault state decided on the masked value (K-16);
`PIN_LASER_ON_HEAD` joins the SDMA pin set and the stop/shutdown
change sets (K-19); the run-start no-data gate refuses the run on a
failed head fetch (K-20); PIC single-register writes reject values
above the documented 10-bit range instead of wrapping (K-21).
**Bench (on the flashed image):** module load/unload clean under
`CONFIG_DEBUG_MUTEXES`; forced `-EPROBE_DEFER` unwinds without a
dangling callback; concurrent `cat` during remove does not fault; the
Phase 1/3/5/6 kernel drills all re-run green on this one image.
**Phase 6 (motion integrity) is code-complete and host-verified.** A **Phase 6 (motion integrity) is code-complete and host-verified.** A
mid-run underrun or stepper fault is no longer silently absorbed: the mid-run underrun or stepper fault is no longer silently absorbed: the