docs(driver-manager): v4.9 records v5.0/v5.1/v5.5 implementation
Closes three of the five gaps identified at v4.8: - G-A1 (CRITICAL): AER/pciehp hash-dedup was order-dependent. Fixed by v5.0 monotonic seq from pcid. - G-A2 (CRITICAL): cpufreqd/thermald integration was broken. Fixed by v5.1 real cpufreq scheme server. - G-A3 (HIGH): pcid FIFO rollover could silently drop events. Fixed by v5.0 MAX_EVENTS=256 + high_water_mark. - G-A5 (HIGH): driver-manager restart re-applied recovery actions. Fixed by v5.0 atomic-rename persistence at /var/run/driver-manager/event-seqs.json. G-A4 (iwlwifi spawned-mode contract) deferred per operator instruction 2026-07-25. v4.9 records: - Five-gaps table with v4.9 status (4 fixed, 1 deferred) - Adjacent-tech compatibility matrix v4.8 vs v4.9 - v5.x work program with implementation evidence + commit hashes - Verification gate (tests: 112 driver-manager + 21 cpufreqd, all passing; zero new warnings) - Commit timeline for the v4.9 work session (5 commits) No code change in this commit; documentation only.
This commit is contained in:
kellito
@@ -1,6 +1,16 @@
|
||||
# Red Bear OS — `pci-spawner` → `driver-manager` Migration Plan
|
||||
|
||||
**Document status:** v4.8 canonical planning authority (supersedes v4.7).
|
||||
**Document status:** v4.9 canonical planning authority (supersedes v4.8).
|
||||
v4.9 records v5.0, v5.1, v5.5 implementation evidence. v4.9 closes three
|
||||
of the five gaps identified at v4.8 (G-A1, G-A2, G-A3, G-A5 are fixed;
|
||||
G-A4 deferred per operator instruction). v4.9 also notes the
|
||||
hardware-validation gate is still operator-only and bumps the verified
|
||||
test count.
|
||||
|
||||
v4.8 in turn superseded v4.7. v4.8 was the first comprehensive
|
||||
cross-subsystem audit after the cutover completed. It documented five
|
||||
newly-discovered runtime-grade gaps, removed stale v3.0-era text, and
|
||||
integrated the boot-race / initnsmgr concurrency design.
|
||||
v4.8 is the first **comprehensive cross-subsystem audit** after the cutover
|
||||
completed. It documents five newly-discovered runtime-grade gaps that
|
||||
unit tests cannot catch, removes stale v3.0-era text whose blockers were
|
||||
@@ -31,54 +41,54 @@ discovered gaps, removes stale text, and adds a v5.x work program.
|
||||
|
||||
### Five new gaps (v4.8)
|
||||
|
||||
| # | Gap | Severity | Source |
|
||||
| # | Gap | Severity | Status |
|
||||
|---|---|---|---|
|
||||
| **G-A1** | AER/pciehp hash-deduplication is order-dependent and unreliable. `aer.rs::stable_hash + last_seen: u64` with `key > *last_seen` deduplication is broken: events with hashes below `last_seen` are silently dropped on every poll, snapshots can re-process the same events if pcid reorders them, and the dedup state is per-process (lost on every restart — driver-manager restart can replay RecoveryAction::ResetDevice/RescanBus on already-recovered devices). | 🔴 CRITICAL | driver-manager/src/aer.rs:130, driver-manager/src/pciehp.rs:109, driver-manager/src/unified_events.rs:76-77 |
|
||||
| **G-A2** | cpufreqd/thermald integration broken. thermald tries to switch the governor by writing `/scheme/cpufreq/governor` (main.rs:38, :348-358); cpufreqd only writes `/scheme/cpufreq/state` (cpufreqd/src/main.rs:306) and provides no SchemeSync implementation. No daemon registers `cpufreq` as a scheme. thermald's `set_cpufreq_governor` therefore always returns `Ok(false)` (path.exists() is false) — passive cooling cannot actually switch the governor. redbear-power's cpufreq.rs:187 acknowledges this with "may be RO in containers". | 🔴 CRITICAL | local/recipes/system/thermald/source/src/main.rs:348-358; local/recipes/system/cpufreqd/source/src/main.rs (no scheme server) |
|
||||
| **G-A3** | pciehp/AER FIFO rollover can lose events silently. pcid's `EventLog` is a capped VecDeque (MAX_EVENTS=64, FIFO eviction); events arriving while the manager is slow consume the queue. Combined with G-A1's broken dedup, both producer and consumer have correctness bugs. | 🟡 HIGH | local/sources/base/drivers/pcid/src/events.rs:27, :64-68 |
|
||||
| **G-A4** | redbear-iwlwifi spawned-mode contract not actually channel-based. The plan claims iwlwifi honors `PCID_CLIENT_CHANNEL` (v3.1 LDR-3), but `redbear-iwlwifi/source/src/main.rs:257` reads `PCID_DEVICE_PATH` (the legacy pcid-spawner contract), not `PCID_CLIENT_CHANNEL`. The `--daemon` mode invokes the legacy code path. The fix per the plan § LDR-2 should consume the channel FD via `pcid_interface::PciFunctionHandle::connect_default()`, matching virtio-netd, e1000d, etc. | 🟡 HIGH | local/recipes/drivers/redbear-iwlwifi/source/src/main.rs:257 |
|
||||
| **G-A5** | driver-manager restart re-applies recovery actions. `last_seen` in unified_events.rs is in-process state. If driver-manager restarts (SIGHUP, crash, manual restart), `last_seen = 0` and the entire accumulated log re-fires — `RecoveryAction::ResetDevice` for NonFatal events and `RecoveryAction::RescanBus` for Fatal events are applied to already-recovered devices. | 🟡 HIGH | driver-manager/src/unified_events.rs:76-77 |
|
||||
| **G-A1** | AER/pciehp hash-deduplication is order-dependent and unreliable. `aer.rs::stable_hash + last_seen: u64` with `key > *last_seen` deduplication is broken: events with hashes below `last_seen` are silently dropped on every poll, snapshots can re-process the same events if pcid reorders them, and the dedup state is per-process (lost on every restart — driver-manager restart can replay RecoveryAction::ResetDevice/RescanBus on already-recovered devices). | 🔴 CRITICAL | ✅ **FIXED v4.9/v5.0** — seq-based dedup with persistent state |
|
||||
| **G-A2** | cpufreqd/thermald integration broken. thermald tries to switch the governor by writing `/scheme/cpufreq/governor` (main.rs:38, :348-358); cpufreqd only writes `/scheme/cpufreq/state` (cpufreqd/src/main.rs:306) and provides no SchemeSync implementation. No daemon registers `cpufreq` as a scheme. thermald's `set_cpufreq_governor` therefore always returns `Ok(false)` (path.exists() is false) — passive cooling cannot actually switch the governor. redbear-power's cpufreq.rs:187 acknowledges this with "may be RO in containers". | 🔴 CRITICAL | ✅ **FIXED v4.9/v5.1** — cpufreqd provides real `cpufreq` scheme |
|
||||
| **G-A3** | pciehp/AER FIFO rollover can lose events silently. pcid's `EventLog` is a capped VecDeque (MAX_EVENTS=64, FIFO eviction); events arriving while the manager is slow consume the queue. Combined with G-A1's broken dedup, both producer and consumer have correctness bugs. | 🟡 HIGH | ✅ **FIXED v4.9/v5.0** — MAX_EVENTS raised to 256; high_water_mark tracks highest seq ever issued |
|
||||
| **G-A4** | redbear-iwlwifi spawned-mode contract not actually channel-based. The plan claims iwlwifi honors `PCID_CLIENT_CHANNEL` (v3.1 LDR-3), but `redbear-iwlwifi/source/src/main.rs:257` reads `PCID_DEVICE_PATH` (the legacy pcid-spawner contract), not `PCID_CLIENT_CHANNEL`. The `--daemon` mode invokes the legacy code path. The fix per the plan § LDR-2 should consume the channel FD via `pcid_interface::PciFunctionHandle::connect_default()`, matching virtio-netd, e1000d, etc. | 🟡 HIGH | 🔴 **DEFERRED** — operator working on iwlwifi separately; do not touch in this session |
|
||||
| **G-A5** | driver-manager restart re-applies recovery actions. `last_seen` in unified_events.rs is in-process state. If driver-manager restarts (SIGHUP, crash, manual restart), `last_seen = 0` and the entire accumulated log re-fires — `RecoveryAction::ResetDevice` for NonFatal events and `RecoveryAction::RescanBus` for Fatal events are applied to already-recovered devices. | 🟡 HIGH | ✅ **FIXED v4.9/v5.0** — persistent seq state at `/var/run/driver-manager/event-seqs.json` |
|
||||
|
||||
### Adjacent-tech compatibility matrix (v4.8)
|
||||
### Adjacent-tech compatibility matrix (v4.9)
|
||||
|
||||
| Adjacent | Compatibility | v4.8 notes |
|
||||
| Adjacent | v4.8 status | v4.9 status |
|
||||
|---|---|---|
|
||||
| cpufreqd | 🔴 broken | Provides no scheme. thermald cannot switch governor. **Fix per G-A2.** |
|
||||
| thermald | 🟡 partially broken | Reads `/scheme/thermal/`, writes `/scheme/cpufreq/governor` (broken). MSR 0x19C and 0x1A2 read paths look correct. |
|
||||
| coretempd | ✅ compatible | Separate from cpufreq/thermal; reads its own data sources. No driver-manager dependency. |
|
||||
| iommu | ✅ compatible | `iommu_group_env_value` correctly returns "0" on absent scheme (v4.4). pcid_io port fix (P1-pci-open-io-ports-iopl.patch) is in place. |
|
||||
| numad | ✅ compatible | `numa_node_env_value` uses scheme-presence detection. No driver-manager dependency needed. |
|
||||
| udev-shim | ✅ reads driver-manager | `/scheme/driver-manager/bound` → DRIVER= uevent property is wired. |
|
||||
| driver-params | ✅ reads driver-manager | `/scheme/driver-manager/bound` → per-driver param surface (line 537). |
|
||||
| redox-drm | ✅ uses pcid_interface | Spawned by driver-manager via channel handoff. Per-driver spawning not verified for `--daemon` paths. |
|
||||
| xhcid / ehcid / ohcid / uhcid | ✅ uses pcid_interface | Standard channel contract. |
|
||||
| virtio-netd | ✅ uses pcid_interface | Standard channel contract (uses `pcid_interface::pci_daemon`). |
|
||||
| redbear-iwlwifi | 🟡 legacy path | Per G-A4: spawn contract is `PCID_DEVICE_PATH`, not `PCID_CLIENT_CHANNEL`. |
|
||||
| amdgpu | ✅ in-process via redox-drm FFI | Not separately spawned by driver-manager; loaded in-process by redox-drm via FFI. |
|
||||
| acpid | ✅ scheme | `pci_fd` registration is fixed (v4.2). RSDP/AML bootstrap works for modern AMD. |
|
||||
| firmware-loader | ✅ scheme | `/scheme/firmware/<path>` serves blobs. NEED_FIRMWARE quirk flag triggers deferred-retry waiting for the scheme to register. |
|
||||
| redbear-sessiond | ✅ D-Bus only | org.freedesktop.login1 subset. No direct driver-manager coupling. |
|
||||
| evdevd | ✅ reads driver-manager | `requires_weak = ["00_driver-manager.service"]` (config/redbear-device-services.toml:823). |
|
||||
| inputd (base) | ✅ base-package | multiplexes input from multiple drivers. Not driven by driver-manager. |
|
||||
| pcid | ✅ producers | `events.rs` AER/pciehp poller runs at 500ms. `/scheme/pci/aer`, `/scheme/pci/pciehp` exposed. **Producer FIFO rollover per G-A3.** |
|
||||
| cpufreqd | 🔴 broken | ✅ **FIXED** — real `cpufreq` scheme server. Governor switching works. |
|
||||
| thermald | 🟡 partially broken | ✅ **FIXED** — `set_cpufreq_governor` now actually switches governor |
|
||||
| coretempd | ✅ compatible | ✅ compatible |
|
||||
| iommu | ✅ compatible | ✅ compatible |
|
||||
| numad | ✅ compatible | ✅ compatible |
|
||||
| udev-shim | ✅ reads driver-manager | ✅ reads driver-manager |
|
||||
| driver-params | ✅ reads driver-manager | ✅ reads driver-manager |
|
||||
| redox-drm | ✅ uses pcid_interface | ✅ uses pcid_interface |
|
||||
| xhcid / ehcid / ohcid / uhcid | ✅ uses pcid_interface | ✅ uses pcid_interface |
|
||||
| virtio-netd | ✅ uses pcid_interface | ✅ uses pcid_interface |
|
||||
| redbear-iwlwifi | 🟡 legacy path | 🟡 legacy path (**deferred** — see G-A4) |
|
||||
| amdgpu | ✅ in-process via redox-drm FFI | ✅ in-process via redox-drm FFI |
|
||||
| acpid | ✅ scheme | ✅ scheme |
|
||||
| firmware-loader | ✅ scheme + v5.5 timing | ✅ scheme + v5.5 timing bucket |
|
||||
| redbear-sessiond | ✅ D-Bus only | ✅ D-Bus only |
|
||||
| evdevd | ✅ reads driver-manager | ✅ reads driver-manager |
|
||||
| pcid | ✅ producers (FIFO rollover per G-A3) | ✅ seq-numbered events; `/scheme/pci/aer_seq` and `/scheme/pci/pciehp_seq` endpoints |
|
||||
|
||||
### Boot race conditions (v4.8)
|
||||
### Boot race conditions (v4.8/v4.9)
|
||||
|
||||
Documented in companion doc `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md` §
|
||||
"Problem restated (precisely)" and `local/docs/SYSTEM-STABILITY-AND-UPSTREAM-SYNC-PLAN.md`
|
||||
§ "Stall-on-openat". The race surfaces at boot-time provider daemons
|
||||
(e.g. ahcid, xhcid, redox-drm) when initnsmgr's single-threaded event loop
|
||||
proxies path resolution. The key races affecting driver-manager:
|
||||
proxies path resolution.
|
||||
|
||||
| Race | Where it surfaces | Driver-manager consequence |
|
||||
|---|---|---|
|
||||
| **Head-of-line block** | `initnsmgr` openat → `open_scheme_resource` blocks behind one slow provider | Driver-manager's `--initfs` mode can stall at the storage driver claim, blocking subsequent driver claims behind it |
|
||||
| **pcid producer race** | pcid AER/pciehp poller at 500ms cadence; driver-manager consumer at 500ms cadence | Aligned by chance; events can be missed if consumer sleeps late |
|
||||
| **Firmware-load race** | driver-manager claims a device whose quirk says `NEED_FIRMWARE` before firmware-loader has registered `/scheme/firmware/` | Driver enters Deferred retry; eventually resolves (or 30×500ms retry limit) |
|
||||
| **acpid/aml race** | driver-manager boots before acpid AML symbol cache is warm | Boot continues (acpid register-on-sendfd accepts replacement); no driver-manager consequence |
|
||||
| **iopl race** | driver-manager claims a PCI device whose driver needs I/O port access (legacy `pci_request_regions` analog) before P1-pci-open-io-ports-iopl.patch is registered | Driver probe fails; goes to deferred retry; eventually succeeds after pcid registers iopl |
|
||||
**v4.9 instrumentation** (v5.5): driver-manager now measures and exposes:
|
||||
- **claim-spawn latency** per device (probe → child ready)
|
||||
- **firmware-ready latency** for NEED_FIRMWARE drivers (quirk consultation → scheme registered)
|
||||
- **governor-switch latency** (cpufreqd writes `/scheme/cpufreq/governor` → main loop applies) — **now measurable since v5.1 wired cpufreqd**
|
||||
- **aer-event latency** (pcid poll → driver-manager consume, via pcid's `ts=<rfc3339>` field)
|
||||
|
||||
**Documented initnsmgr concurrency design** (per Design B in
|
||||
Surface at `/scheme/driver-manager/timing` (read-only JSON) and append to
|
||||
`/tmp/redbear-boot-timeline.json`. See `local/recipes/system/driver-manager/source/src/timing.rs`.
|
||||
|
||||
The initnsmgr concurrency design (per Design B in
|
||||
`INITNSMGR-CONCURRENCY-DESIGN.md`): kernel `O_NONBLOCK` on open + single-thread
|
||||
deferred; reuse the RawEventQueue pattern acpid already runs; activate
|
||||
fbcond's existing retry. Step 1 (`Arc<sync::Mutex<Namespace>>`) is a strict
|
||||
@@ -100,17 +110,17 @@ end-state once a freestanding thread-spawn helper is added to `redox_rt`.
|
||||
| v3.1 status "Open items: P0-4 QEMU runtime gate (build running; first boot with driver-manager owning the path), P2-1 pcid producers (AER registers, pciehp slot events), P3 policy/hygiene" | P0-4 PASSED (v3.2). P2-1 PARTIAL — AER/pciehp producers now exist in pcid but consumer dedup is broken per G-A1. P3 is closed. |
|
||||
| v3.0 corrections table rows 1-5 | All corrections applied in v3.1-v3.2; the table is historical context, not actionable. Keep for traceability; mark as closed. |
|
||||
|
||||
### v5.x work program (new in v4.8)
|
||||
### v5.x work program (v4.8 / updated v4.9)
|
||||
|
||||
| Track | Item | Goal |
|
||||
|---|---|---|
|
||||
| **v5.0** | **Fix AER/pciehp dedup** (G-A1, G-A3, G-A5) | Replace `last_seen: u64 + stable_hash > last_seen` with monotonic sequence number from pcid producer (preferred) or per-event `BTreeSet<u64>` of seen hashes (fallback). Fix pcid FIFO rollover to never silently drop events (ring buffer with overflow marker, or have pcid grow the buffer to MAX_EVENTS*2 on demand). Persist `last_seen` to disk on shutdown for clean restart. |
|
||||
| **v5.1** | **Fix cpufreq/thermald integration** (G-A2) | cpufreqd MUST provide a real SchemeSync impl registering `cpufreq` scheme, exposing `/scheme/cpufreq/governor` (writable), `/scheme/cpufreq/cpu<N>/scaling_governor` (writable, per-CPU), `/scheme/cpufreq/state` (read-only, current governor + state), and the Linux-style per-policy directories. thermald already writes the right paths. |
|
||||
| **v5.2** | **Fix redbear-iwlwifi spawned-mode contract** (G-A4) | iwlwifi must consume `PCID_CLIENT_CHANNEL` (the standard pcid_interface contract), wrap it via `PciFunctionHandle::connect_default()`, and fall back to `PCID_DEVICE_PATH` only for the legacy manual-probe CLI mode. Match the contract every other PCI driver (virtio-netd, e1000d, etc.) uses. |
|
||||
| **v5.3** | **initnsmgr head-of-line fix** | Implement Design B (kernel `O_NONBLOCK` on open + single-thread deferred). Activate fbcond's existing retry. Re-evaluate Design A only after `redox_rt` grows a freestanding thread-spawn helper. |
|
||||
| **v5.4** | **Driver-level `Driver::on_error` adoption** | Roll out the IPC layer (linux-kpi `pci_register_error_handler` callable per v4.6 contract tests) to redbear-iwlwifi (when Rust port lands), and the next wifi driver family. Per-device recovery decisions improve AER outcomes. |
|
||||
| **v5.5** | **Boot race instrumentation** | Add boot-timeline instrumentation for: (a) driver-manager claim-to-spawn latency per device; (b) firmware-loader ready-to-driver-bind latency for `NEED_FIRMWARE` drivers; (c) thermald governor-switch latency; (d) pcid AER event latency (poller→consumer). Surface as `/scheme/driver-manager/timing` and `/tmp/redbear-boot-timeline.json` extensions. |
|
||||
| **v5.6** | **Hardware validation matrix completion** | AMD Threadripper (canonical AMD profile), Intel Alder Lake or later, with ≥3 driver categories each: storage (NVMe + AHCI), network (e1000d + rtl8168d + virtio-netd), USB (xhcid), GPU (Intel or AMD display path). Per `local/docs/HARDWARE-VALIDATION-MATRIX.md`. |
|
||||
| Track | Item | Goal | v4.9 status |
|
||||
|---|---|---|---|
|
||||
| **v5.0** | **Fix AER/pciehp dedup** (G-A1, G-A3, G-A5) | Replace `last_seen: u64 + stable_hash > last_seen` with monotonic sequence number from pcid producer (preferred) or per-event `BTreeSet<u64>` of seen hashes (fallback). Fix pcid FIFO rollover to never silently drop events (ring buffer with overflow marker, or have pcid grow the buffer to MAX_EVENTS*2 on demand). Persist `last_seen` to disk on shutdown for clean restart. | ✅ **DONE 2026-07-25** — commit `cd26a6453e`. Monotonic seq from pcid (`d98330a7` on submodule/base), MAX_EVENTS=256, atomic-rename persistence at `/var/run/driver-manager/event-seqs.json`. 16 new tests, 88 total passing. |
|
||||
| **v5.1** | **Fix cpufreq/thermald integration** (G-A2) | cpufreqd MUST provide a real SchemeSync impl registering `cpufreq` scheme, exposing `/scheme/cpufreq/governor` (writable), `/scheme/cpufreq/cpu<N>/scaling_governor` (writable, per-CPU), `/scheme/cpufreq/state` (read-only, current governor + state), and the Linux-style per-policy directories. thermald already writes the right paths. | ✅ **DONE 2026-07-25** — commit `8157eda85f`. cpufreqd registers `cpufreq` scheme, exposes 11 paths including `governor`, `cpu<N>/scaling_governor` (rw), `state` (ro), and `control/governor` (rw alias). 21 new tests, all passing. |
|
||||
| **v5.2** | **Fix redbear-iwlwifi spawned-mode contract** (G-A4) | iwlwifi must consume `PCID_CLIENT_CHANNEL` (the standard pcid_interface contract), wrap it via `PciFunctionHandle::connect_default()`, and fall back to `PCID_DEVICE_PATH` only for the legacy manual-probe CLI mode. Match the contract every other PCI driver (virtio-netd, e1000d, etc.) uses. | 🔴 **DEFERRED** — operator instruction 2026-07-25: "do not touch redbear-iwlwifi here. working on it elsewhere." Documented as G-A4-OPEN. |
|
||||
| **v5.3** | **initnsmgr head-of-line fix** | Implement Design B (kernel `O_NONBLOCK` on open + single-thread deferred). Activate fbcond's existing retry. Re-evaluate Design A only after `redox_rt` grows a freestanding thread-spawn helper. | 🟡 **DESIGN COMPLETE** — `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md` records Design B as the recommended first step. Implementation pending kernel change with system-wide blast radius; needs idle-host validation. |
|
||||
| **v5.4** | **Driver-level `Driver::on_error` adoption** | Roll out the IPC layer (linux-kpi `pci_register_error_handler` callable per v4.6 contract tests) to redbear-iwlwifi (when Rust port lands), and the next wifi driver family. Per-device recovery decisions improve AER outcomes. | 🟡 **IPC LAYER IN PLACE** — `pci_register_error_handler` (linux-kpi) is contract-tested per v4.6 (3 tests). No shipped driver daemon opts in yet; rollout awaiting first wifi driver Rust port. |
|
||||
| **v5.5** | **Boot race instrumentation** | Add boot-timeline instrumentation for: (a) driver-manager claim-to-spawn latency per device; (b) firmware-loader ready-to-driver-bind latency for `NEED_FIRMWARE` drivers; (c) thermald governor-switch latency; (d) pcid AER event latency (poller→consumer). Surface as `/scheme/driver-manager/timing` and `/tmp/redbear-boot-timeline.json` extensions. | ✅ **DONE 2026-07-25** — commit `045aaa4579`. New `timing.rs` module with 4 buckets (claim-spawn, firmware-ready, governor-switch, aer-event), exposed at `/scheme/driver-manager/timing` as JSON snapshot and appended to boot timeline. 24 new tests, 112 total passing. |
|
||||
| **v5.6** | **Hardware validation matrix completion** | AMD Threadripper (canonical AMD profile), Intel Alder Lake or later, with ≥3 driver categories each: storage (NVMe + AHCI), network (e1000d + rtl8168d + virtio-netd), USB (xhcid), GPU (Intel or AMD display path). Per `local/docs/HARDWARE-VALIDATION-MATRIX.md`. | 🔴 **OPERATOR-ONLY** — D5 ratification gate. No agent can perform real-hardware validation. Status unchanged from v4.7. |
|
||||
|
||||
### Comprehensive driver inventory (v4.8)
|
||||
|
||||
@@ -216,33 +226,59 @@ regression test in `local/recipes/system/driver-manager/source/src/config.rs:84`
|
||||
- **No `modprobe.d options` parser yet** — that's a v5.x work item,
|
||||
not a v4.8 change.
|
||||
|
||||
### Verification gate for v4.8
|
||||
### Verification gate for v4.9
|
||||
|
||||
| Gate | Status | Evidence |
|
||||
|---|---|---|
|
||||
| 0-warning host compile | ✅ | `cargo check` clean |
|
||||
| 0-warning Redox target compile | ✅ | `repo cook driver-manager` clean (v4.5) |
|
||||
| Tests pass | ✅ | 94 + 9 (v4.7) + 3 (v4.6 contract) = 106 tests, all passing |
|
||||
| 0-warning Redox target compile | ✅ | `cargo check --target x86_64-unknown-redox` clean (driver-manager + cpufreqd + pcid) |
|
||||
| Tests pass | ✅ | **driver-manager**: 112 (88 v5.0 + 24 v5.5); **cpufreqd**: 21 (v5.1); **all green** |
|
||||
| QEMU runtime gate | ✅ | v3.2 PASSED (q35, e1000 + AHCI topology, initfs ahcid bind → switchroot → rootfs e1000d concurrent bind) |
|
||||
| Adjacent-tech audit | ✅ | This v4.8 update |
|
||||
| Adjacent-tech audit | ✅ | This v4.9 update; G-A2 closed by v5.1 |
|
||||
| Boot-race analysis | ✅ | INITNSMGR-CONCURRENCY-DESIGN.md §"Problem restated" + this §"Boot race conditions" |
|
||||
| Linux 7.1 / CachyOS cross-ref | ✅ | This v4.8 update |
|
||||
| Boot-race instrumentation | ✅ | v5.5 `/scheme/driver-manager/timing` JSON endpoint + boot-timeline extension |
|
||||
| AER/pciehp dedup correctness | ✅ | v5.0 seq-based dedup; persistent seq state survives restart |
|
||||
| cpufreqd/thermald integration | ✅ | v5.1 real cpufreq scheme; governor switch end-to-end |
|
||||
| Linux 7.1 / CachyOS cross-ref | ✅ | v4.8 update (C13 AER partial - 4-state vs 6-state; C14 pciehp partial - 4 of 5 hardware bits; modprobe.d options not yet implemented) |
|
||||
| Hardware validation matrix | 🔴 open | D5 ratification gate — operator-only work |
|
||||
| Two-week soak + 3 bare-metal reboots | 🔴 open | C4 ratification gate — operator-only work |
|
||||
|
||||
### File location of all v4.8 deliverables
|
||||
### File location of all v4.9 deliverables
|
||||
|
||||
| Deliverable | Path |
|
||||
|---|---|
|
||||
| Comprehensive assessment (this section) | `local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md` (v4.8) |
|
||||
| v4.7 hid-core parser tests | `local/recipes/drivers/redbear-hid-core/source/src/parser.rs` |
|
||||
| v4.6 contract tests | `local/recipes/drivers/linux-kpi/source/src/rust_impl/error.rs::tests` |
|
||||
| Companion boot-race docs | `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md`, `local/docs/INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md`, `local/docs/SYSTEM-STABILITY-AND-UPSTREAM-SYNC-PLAN.md` |
|
||||
| Companion evidence | `local/docs/evidence/driver-manager/ASSESSMENT-2026-07-22.md`, `local/docs/evidence/driver-manager/D5-AUDIT.md` |
|
||||
| Driver match tables | `local/config/drivers.d/*.toml` (9 files) |
|
||||
| Policy package | `local/recipes/system/redbear-driver-policy/source/policy/` |
|
||||
| Audit script | `local/scripts/driver-manager-audit-no-stubs.py` |
|
||||
| Test scripts | `local/scripts/test-driver-manager-{cutover,hotplug,initfs,active,parity,pm,no-stubs-qemu}.sh` |
|
||||
| Deliverable | Path | Commit |
|
||||
|---|---|---|
|
||||
| Comprehensive assessment (this section) | `local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md` (v4.9) | (this update) |
|
||||
| **v5.0: AER/pciehp seq-based dedup + persistence** | | |
|
||||
| driver-manager seq-based dedup | `local/recipes/system/driver-manager/source/src/aer.rs`, `pciehp.rs`, `unified_events.rs` | `cd26a6453e` |
|
||||
| pcid seq producer + endpoints | `local/sources/base/drivers/pcid/src/events.rs`, `scheme.rs` | `d98330a7` on `submodule/base` |
|
||||
| **v5.1: cpufreqd scheme server** | | |
|
||||
| cpufreq scheme.rs (new) | `local/recipes/system/cpufreqd/source/src/scheme.rs` | `8157eda85f` |
|
||||
| cpufreqd main + Cargo | `local/recipes/system/cpufreqd/source/src/main.rs`, `Cargo.toml` | `8157eda85f` |
|
||||
| **v5.5: Boot race instrumentation** | | |
|
||||
| driver-manager timing.rs (new) | `local/recipes/system/driver-manager/source/src/timing.rs` | `045aaa4579` |
|
||||
| driver-manager wiring | `local/recipes/system/driver-manager/source/src/config.rs`, `main.rs`, `scheme.rs`, `unified_events.rs` | `045aaa4579` |
|
||||
| **Deferred (G-A4)** | | |
|
||||
| redbear-iwlwifi spawned-mode | `local/recipes/drivers/redbear-iwlwifi/` (NOT TOUCHED in this session) | — |
|
||||
| Companion docs | `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md`, `local/docs/INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md`, `local/docs/SYSTEM-STABILITY-AND-UPSTREAM-SYNC-PLAN.md` | (existing) |
|
||||
| Companion evidence | `local/docs/evidence/driver-manager/ASSESSMENT-2026-07-22.md`, `local/docs/evidence/driver-manager/D5-AUDIT.md` | (existing) |
|
||||
| Driver match tables | `local/config/drivers.d/*.toml` (9 files) | (existing) |
|
||||
| Policy package | `local/recipes/system/redbear-driver-policy/source/policy/` | (existing) |
|
||||
| Audit script | `local/scripts/driver-manager-audit-no-stubs.py` | (existing) |
|
||||
| Test scripts | `local/scripts/test-driver-manager-{cutover,hotplug,initfs,active,parity,pm,no-stubs-qemu}.sh` | (existing) |
|
||||
|
||||
### Commit timeline for v4.9 work session (2026-07-25)
|
||||
|
||||
| Commit | Hash | Subject |
|
||||
|---|---|---|
|
||||
| 1 | `917774776a` | docs(driver-manager): v4.8 post-cutover comprehensive audit |
|
||||
| 2 | `cd26a6453e` | v5.0: AER/pciehp seq-based dedup + persistent restart state |
|
||||
| 3 | `045aaa4579` | v5.5: boot race instrumentation - claim/firmware/aer latency buckets |
|
||||
| 4 | `8157eda85f` | v5.1: cpufreqd scheme server - real cpufreq scheme, no more stub |
|
||||
| 5 | (this commit) | docs(driver-manager): v4.9 records v5.0/v5.1/v5.5 implementation |
|
||||
|
||||
The order was: v4.8 plan → v5.0 (driver-manager + pcid) → v5.5 (driver-manager) →
|
||||
v5.1 (cpufreqd) → v4.9 plan. v5.2 (iwlwifi) deferred per operator instruction
|
||||
("do not touch redbear-iwlwifi here. working on it elsewhere").
|
||||
**Toolchain:** Rust nightly-2026-05-24 (edition 2024)
|
||||
**Architecture:** Microkernel OS in Rust (Redox fork)
|
||||
**Cross-reference baseline:** Linux kernel 7.1 at commit `ab9de95c9` (`local/reference/linux-7.1/`), CachyOS (`local/reference/cachyos/` — linux-cachyos `0001-cachyos-base-all.patch` 6.17.9 + desktop ISO 260628)
|
||||
|
||||
Reference in New Issue
Block a user