Grep-based test banning raw std::thread::sleep / thread::sleep calls in
production code under src/aacs, src/css and src/ld, per Stop design v5
§5.8. clippy's disallowed-methods can't scope to a subdirectory, hence
a dedicated test rather than a lint config entry. No violations found;
this is a pure addition.
WallClock's wait between TEST UNIT READY polls is now the transport's
cancellable pause (stop-design-v5 §2.3), so a Stop during the poll ends it
at once. The refusal is the dead-bus shape; libfreemkv's Drive::init
reclassifies it as Halted (ST-L2).
stop-design-v5 §2.3, second commit of the two-commit shape (UT1-UT9 green):
- AACS: aacs1_ake / aacs2_authenticate_p256_with_anchor return the AGID in
its AgidGuard; finish_auth takes it and releases on every exit, so the
1.0 AGID is freed before the P-256 fall-through. release_agid is gone:
exactly one release per allocation, through execute_cleanup (SS-7).
- CSS: the AGID is guarded during the challenge and defused on success,
still held for read_disc_key (D9); the pre-allocation invalidate sweep
stays on execute, so a Stop refuses it.
- MT1959: A's WRITE BUFFER + verify (D8, C_max 35 s) and B's MODE SELECT,
READ BUFFER, WRITE BUFFER, F1 (C_max 45 s) run in a CriticalGuard;
do_unlock and the retries stay cancellable.
- The per-cert backoff uses pause; an interrupted wait aborts as Transport.
- The test-only FwFront forwards all four new methods.
UnlockError, the Unlocker trait and every public signature are unchanged.
stop-design-v5 §2.3 / §5.2 (ST-U1), first commit of the two-commit shape.
Additive: four defaulted ScsiTransport methods (pause, begin_critical,
end_critical, execute_cleanup), so all 32 in-repo impls compile unchanged,
plus the CriticalGuard and AgidGuard types and the StopFake test host that
behaves like libfreemkv's adapter after a Stop.
Red on this commit (nothing is wired yet): UT2 v1/v2 and the CSS release
test (a held AGID is released via execute, which a Stop refuses), UT3,
UT6 (FwFront does not forward), UT7/UT8 (the verify / F1 are refused
mid-upload), UT9 backoff (a real 1 s sleep, no pause). Green: UT1, UT4
(GUARD, D9), UT5 (NEW).
Review of ST-D10 (changes required). await_media_ready now returns a
MediaReady outcome, and run_init keeps the unlock for every outcome, so
LdUnlocker still reports Some and runs probe_disc and the VID read. It
fails only on a dead bus or a Stop. The NotReady ld error (7104) is gone.
It follows libfreemkv wait_ready's terminal states, quoting MMC-6 r02g
Annex F. After 10 x 02/3A (MEDIUM NOT PRESENT) with no 02/04/01 it returns
NoMedium. On 02/04/02 (INITIALIZING CMD. REQUIRED) it sends one START
STOP UNIT (1B 00 00 00 01 00, Table 633 "Start the disc and make ready
for access"), counted as progress. On 02/30/xx it returns Incompatible
at once, and on sense keys 3/4/5 DriveError at once. UNIT ATTENTION
06/29/00 and 06/28/00 keep polling. A T6 stall returns Stalled (warn),
still Ok.
An Err carrying a sense (libfreemkv's adapter returns non-zero status that
way) is a drive answer, not a dead bus. TODO: the SKSV progress indicator
(T6 part 2). New LdUnlocker-level test: a 60 s stall after a confirmed
upload still reports Some, and probe_disc runs after the poll.
Review of ST-D10 (changes required). LdUnlocker exits on `mt.init(scsi)?`,
so the poll's NotReady error turned a real unlock into NotApplicable,
skipping probe_disc and the VID read. Red on 24909ba: a stall, a flapping
drive, 10 x 02/3A without 04/01, 02/30/xx, sense keys 3/4/5 and an Err
carrying a sense (libfreemkv's adapter shape) are errors or 60 s stalls,
and 02/04/02 sends no START STOP UNIT. Guards (green): UNIT ATTENTION
06/29, 06/28 then ready; 3A after 04/01 keeps polling.
A confirmed load_firmware proves only that the new firmware answers vendor
READ BUFFERs. libfreemkv's session runs wait_ready before init and never
after, so run_probe's READ CAPACITY could see NOT READY, probe a UHD disc at
the BD address, and spin validate's five retries.
After a confirmed upload, run_init now polls TEST UNIT READY every 500 ms
until the drive is ready. Per T6 (stop-design-v5 §2.11), progress is a
(sense key, ASC, ASCQ) answer not yet seen in this poll; it fails with the
new internal ld Error::NotReady (7104, maps to NotApplicable) only after
60 s without progress. There is no total cap, and a dead bus aborts at
once. The wait sits behind a ReadyClock seam, so the tests run the window
on a virtual clock. ST-U1 turns the wait into the cancellable pause.
Review of ST-D10: a confirmed load_firmware proves only that the new
firmware answers vendor READ BUFFERs, not that the media is ready, and
libfreemkv's session calls wait_ready before init, never after. Red on
712e58d: run_init returns without a TEST UNIT READY. UT10 now also expects
the one ready TUR.
load_firmware returns Ok only after its own do_unlock succeeded. run_init
then slept 10 s and re-ran do_unlock, and on attempt 2 fell out of the loop
returning Err(last_err), discarding a real unlock. Return Ok at once; the
firmware upload itself is unchanged (stop-design-v5 §1 D10, ST-D10).
stop-design-v5 §5.2 UT10 / G3 (D10). Red on dev: after a confirmed
load_firmware, run_init settles 10 s and loops back into do_unlock, and a
confirmation on the last attempt is discarded as Err(last_err).
Share one IDENTITY reply fixture; assert UnsupportedFirmware/InvalidArgument;
cover the v2 length gate under P-256 and dead-bus/rejected VID after an arm.
Adds the org doc-links caller, cargo test --doc, and a consumers job building
libfreemkv and bdemu against this commit. ci/qa default to contents: read.
0.8.x de-bus via 0x06 is hardware-dependent, not validated; 0.7.1 replies "freemkv 0.7.1".
Note arm_stealth_oem's version gate vs raw reset(); FwMock Bd slot at its default.
Parse only the IDENTITY version token; refuse fw < 0.9 in FreemkvUnlocker and every arm recipe.
AACS arm runs before the cert check; an Encryption=off arm returns the bare VID. Unlocked zeroizes on drop.
Mark the 1.0 drive dead only for a type-0x01 cert failing LA verify or a type-0x11
cert; zeroed/unknown types and step-6/9 failures stay per-cert. Log the skip.
Drop the unreachable ILLEGAL_REQUEST wedge arm; stop retrying host certs after a
drive-side 1.0 verify failure; skip truncated/known-dead v1 creds up front; read
fmt 0x84 only from a Bus Encryption Capable drive; accept unreduced keydb scalars.
find_by_drive_id ran the four-field fallback per section, so an earlier
section's fallback beat a later section's exact match. Exact pass now spans
all sections first; fallback uniqueness is checked across all sections.
The 1.7.6 unified release ships no rip-path change (Linux desktop shell,
notifications, menu_layout refactor, XDG paths). Real-media QA on EC2
adds ~2h + real money to the release cycle to prove code that never
enters the rip pipeline. This empty commit puts `[skip-media]` in qa's
HEAD so the media matrix in qa.yml auto-skips per the documented bypass;
the full-platform builds/tests still run.
Release-orchestrate committed to qa (v1.7.5 version bump, etc.) but did
not push those commits back to dev, so promote's fast-forward gate
refused (qa was diverged from dev). This is an ours-merge: the commit
records qa as an ancestor of dev without applying its content, since
dev has already moved past 1.7.5 to 1.7.6 with the equivalent
information in place.
Bumps Cargo.toml + Cargo.lock to 1.7.6. Also fixes a CI-shape defect the
previous release left behind: dev's CHANGELOG still said
`## [1.7.5] — UNRELEASED` after 1.7.5 shipped (release-orchestrate dated
main but did not push a fresh UNRELEASED heading back to dev). Corrects
that here so the changelog job accepts 1.7.6 on the way to qa:
## [1.7.6] — UNRELEASED
- Version aligned; unified release driven by freemkv 1.7.6.
## [1.7.5] — 2026-09-23
- Version aligned (or actual content, per the shipped main entry).
The driver for 1.7.6 is the freemkv Linux desktop shell (GTK4 +
libadwaita) + rip-finished desktop notification (issue #56).
Firmware 0.9.0 consolidates the Ake (0x06) and Bus (0x07) features into a
single Encryption (0x06) lever; wire id 0x07 no longer exists. The separate
Bus lever was proven inert on BU40N/MT1959 — the one Encryption lever
de-busses on its own — so the unlock recipe now sets one flag where it used
to set two, and the trailing best-effort Set(Bus, off) is gone.
Set(Encryption, STATE_OFF) is the load-bearing step: the drive acts
pre-authenticated, so a bare 0xAD returns the VID with no cert and no AKE,
and content comes back de-bussed. Failure still maps to VidUnavailable.
Hardware-validated against fw 0.9.0 on BU40N 1.00 with a UHD disc: every
sampled unit returns de-bussed and opens with the AACS unit key resolved
from the live keyserver.
Replace comment/leak/identity guard workflows with thin callers into
freemkv/.github reusable guards (guard-comment/leak/identity @v1); fork
PRs still run, same-repo pushes aren't double-run. Delete now-unused
local ci/comment-guard.py and ci/leak-guard.sh. Add top-level
concurrency (cancel-in-progress) to ci.yml and qa.yml and standardize
actions/checkout to @v5.
arm_bypass_bd/arm_bypass_uhd now also Set(Hrl, off) (revocation skip) so a
revoked/absent cert never trips the HRL check on a keyless bypass rip; tests
updated for the new SET/verify order.
Matthew Jackson