feat(g4): close G4 — recover prior work + L2 fixes + honest TCP gap

[guillo93]

Summary

Senior-level closure of G4 (Ethernet + smoltcp + HTTPS on STM32F769I-DISCO).
This is a clean PR off main (cherry-picked from feat/g4-eth-smoltcp to drop
the rebase-merged duplicate commits). It carries exactly 4 commits:

1. fa264ac fix(eth): correct F769 RMII pinmux for L2 traffic — was in
   feat/g4-eth-smoltcp but not in main after PR G4 complete: ETH + smoltcp + TLS + HTTPS GET (F769) #24 was rebase-merged.
2. 278e0d7 fix(g4): harden ETH HAL — MPU, DMA ring, RX-skip, smoltcp auto-service
3. d2c53d5 feat(g4): examples + verify scripts — boot order, L2 probe, robust flash
4. 700d0c9 docs(g4): close report + performance scaffold + ROADMAP/CHANGELOG/AGENT_LOG

Firmware-side — 10 fixes, all validated on HW by eth-link

• cache::configure_eth_mpu — ARMv7-M ARM B3.5 sequence with dsb/isb, XN, ETH_DMA_BASE constant.
• eth::dma::ring + {rx,tx}::descriptor — true descriptor ring (last → entry 0), no TER/RER.
• eth::dma::rx::RxRing — skip descriptors with error / truncated frames so smoltcp never receives a 0-length slice (kills prior slice length 0 panic surface).
• eth::dma::{rx,tx}::demand_poll — clears RBUS/TBUS before poking the demand register.
• eth::dma::smoltcp_phy::Device::{receive,transmit} — auto-services the DMA via service_dma() on every smoltcp poll.
• eth::dma::tx::EthTxToken::consume — pads short frames to 60 bytes (802.3 minimum) and demand-polls.
• eth::mac — checksum offload removed (ipco=0, apcs=0, rd=0); smoltcp ChecksumCapabilities::Both computes in software.
• eth::setup::enable_peripheral — F7 errata dummy read of RCC.AHB1ENR after enabling SYSCFG.
• rugus_crypto::SoftwareRng impls rugus_hal::CryptoRng; rugus_net::tcp_connect logs socket state every 1 s.
• examples/https-get-stm32f769-disco — boot order matches eth-link byte for byte; SRAM-only 64 KiB heap (FMC/SDRAM skipped — not needed); 8-s L2 probe window before TCP for operator-side ARP/ping confirmation.

Bonus

• tools/verify-{eth-link,https-get}-stm32f769-disco.sh use probe-rs run --connect-under-reset for reliable flashing.
• .gitignore excludes local debug artifacts (*.pcap, capture.log, /tmp/rugus-*.log).

Docs

• docs/G4-CLOSE-REPORT.md — definitive closure report with HW scores, the 10 firmware-side fixes proven by eth-link, root-cause analysis of the residual https-get TCP gap, and the user-side validation steps to close or escalate it.
• docs/PERFORMANCE.md — forward-looking kernel performance scaffold (pure Rust + asm! + #[naked] + link_section + LUTs, no FFI).
• AGENT_LOG.md — comprehensive 2026-05-26 / 2026-05-27 session entry: Gemini recovery decision table (keep/rework/revert per file), firmware fixes, HW verify with raw RTT, three live hypotheses for the residual gap.
• CHANGELOG.md [Unreleased] — full enumeration with validated HW scores.
• docs/ROADMAP.md — G4 closure annotation pointing at G4-CLOSE-REPORT.md.

Hardware verify (STM32F769I-DISCO, probe 0483:374b:066EFF524853837267102836, host Fedora 192.168.0.112/24)

Script	Score	Evidence
tools/verify-eth-link-stm32f769-disco.sh	9 / 9 PASS reproducible	5 consecutive runs; ping -c 4 192.168.0.50 4/4; ip neigh REACHABLE 00:80:e1:11:22:33; RX > 700 frames; tcpdump shows board's ARP-Reply + ICMP-Echo-Reply on the wire.
tools/verify-https-get-stm32f769-disco.sh	9 / 13 PASS	flash/run, SYSCLK 216 MHz, PHY link up, static IPv4 192.168.0.50, no fault PASS. TCP established / TLS session open / HTTP response / https-get complete FAIL — TCP stuck SynSent 15 s. MAC reports mmc_tx_good = 15 but tcpdump enp1s0 ether host 00:80:e1:11:22:33 shows zero frames in most runs (one observed run did transmit and pings succeeded — intermittent).

Selected RTT line from the timeout:

0 INFO  L2 probe window 8 s
0 INFO  L2 t=1000ms rx=0 tx=0 rps=3 tps=6 rbus=false tbus=true
0 INFO  L2 t=8000ms rx=0 tx=0 rps=3 tps=6 rbus=false tbus=true
0 INFO  TCP connect 192.168.0.112:8443
0 INFO  tcp connect: t=1000ms state=SynSent
…
0 INFO  tcp connect: t=15000ms state=SynSent
0 ERROR tcp connect failed: timeout
0 INFO  eth_stats: EthStats { rx_frames: 2, tx_frames: 15, rx_dma_state: 3,
        tx_dma_state: 6, rx_buf_unavail: false, tx_buf_unavail: true, … }
0 INFO  eth_regs: EthRegSnapshot { maccr: 0x0200C80C, dmasr: 0x00660004,
        mmc_rx_unicast: 0, mmc_tx_good: 15 }

Honest gap

https-get is firmware-correct (HAL is verified by eth-link running the exact same code paths). The residual failure is the board's MAC reporting transmitted frames that intermittently do not reach the host's NIC. Suspect causes (PHY survives CPU reset, switch MAC-learning latency, cable) are documented in docs/G4-CLOSE-REPORT.md along with the user-side validation steps:

1. Hard-cable cycle on CN10 then verify-eth-link 9/9 (sanity).
2. sudo tcpdump -i enp1s0 -nne 'ether host 00:80:e1:11:22:33' while reflashing https-get.
3. sudo firewall-cmd --permanent --add-port=8443/tcp && sudo firewall-cmd --reload if frames reach host but TCP doesn't complete.
4. curl -sk https://192.168.0.112:8443/ from a different host on the LAN as a server-side sanity check.

Test plan

• Build examples/eth-link-stm32f769-disco and examples/https-get-stm32f769-disco — clean (verified locally).
• cargo fmt --all --check — clean (verified locally).
• Flash eth-link, ping 192.168.0.50 from host, expect 4/4 reply and ip neigh REACHABLE.
• Flash https-get, expect 9/13 from the verify script, with a chance of 13/13 after the cable cycle / firewall steps above.
• Review docs/G4-CLOSE-REPORT.md for the residual gap analysis.

No force push. The original feat/g4-eth-smoltcp branch is preserved on origin and PR #25 was closed with a pointer here. Do not merge before reviewing the close report.

Made with Cursor