From 2bee5b332bcd296a73b75738dc51541411a0381d Mon Sep 17 00:00:00 2001 From: kellito Date: Sun, 26 Jul 2026 00:27:46 +0900 Subject: [PATCH] docs(driver-manager): v4.9 records v5.0/v5.1/v5.5 implementation Closes three of the five gaps identified at v4.8: - G-A1 (CRITICAL): AER/pciehp hash-dedup was order-dependent. Fixed by v5.0 monotonic seq from pcid. - G-A2 (CRITICAL): cpufreqd/thermald integration was broken. Fixed by v5.1 real cpufreq scheme server. - G-A3 (HIGH): pcid FIFO rollover could silently drop events. Fixed by v5.0 MAX_EVENTS=256 + high_water_mark. - G-A5 (HIGH): driver-manager restart re-applied recovery actions. Fixed by v5.0 atomic-rename persistence at /var/run/driver-manager/event-seqs.json. G-A4 (iwlwifi spawned-mode contract) deferred per operator instruction 2026-07-25. v4.9 records: - Five-gaps table with v4.9 status (4 fixed, 1 deferred) - Adjacent-tech compatibility matrix v4.8 vs v4.9 - v5.x work program with implementation evidence + commit hashes - Verification gate (tests: 112 driver-manager + 21 cpufreqd, all passing; zero new warnings) - Commit timeline for the v4.9 work session (5 commits) No code change in this commit; documentation only. --- local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md | 164 ++++++++++++-------- 1 file changed, 100 insertions(+), 64 deletions(-) diff --git a/local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md b/local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md index 62f764b17b..701b3f2c66 100644 --- a/local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md +++ b/local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md @@ -1,6 +1,16 @@ # Red Bear OS β€” `pci-spawner` β†’ `driver-manager` Migration Plan -**Document status:** v4.8 canonical planning authority (supersedes v4.7). +**Document status:** v4.9 canonical planning authority (supersedes v4.8). +v4.9 records v5.0, v5.1, v5.5 implementation evidence. v4.9 closes three +of the five gaps identified at v4.8 (G-A1, G-A2, G-A3, G-A5 are fixed; +G-A4 deferred per operator instruction). v4.9 also notes the +hardware-validation gate is still operator-only and bumps the verified +test count. + +v4.8 in turn superseded v4.7. v4.8 was the first comprehensive +cross-subsystem audit after the cutover completed. It documented five +newly-discovered runtime-grade gaps, removed stale v3.0-era text, and +integrated the boot-race / initnsmgr concurrency design. v4.8 is the first **comprehensive cross-subsystem audit** after the cutover completed. It documents five newly-discovered runtime-grade gaps that unit tests cannot catch, removes stale v3.0-era text whose blockers were @@ -31,54 +41,54 @@ discovered gaps, removes stale text, and adds a v5.x work program. ### Five new gaps (v4.8) -| # | Gap | Severity | Source | +| # | Gap | Severity | Status | |---|---|---|---| -| **G-A1** | AER/pciehp hash-deduplication is order-dependent and unreliable. `aer.rs::stable_hash + last_seen: u64` with `key > *last_seen` deduplication is broken: events with hashes below `last_seen` are silently dropped on every poll, snapshots can re-process the same events if pcid reorders them, and the dedup state is per-process (lost on every restart β€” driver-manager restart can replay RecoveryAction::ResetDevice/RescanBus on already-recovered devices). | πŸ”΄ CRITICAL | driver-manager/src/aer.rs:130, driver-manager/src/pciehp.rs:109, driver-manager/src/unified_events.rs:76-77 | -| **G-A2** | cpufreqd/thermald integration broken. thermald tries to switch the governor by writing `/scheme/cpufreq/governor` (main.rs:38, :348-358); cpufreqd only writes `/scheme/cpufreq/state` (cpufreqd/src/main.rs:306) and provides no SchemeSync implementation. No daemon registers `cpufreq` as a scheme. thermald's `set_cpufreq_governor` therefore always returns `Ok(false)` (path.exists() is false) β€” passive cooling cannot actually switch the governor. redbear-power's cpufreq.rs:187 acknowledges this with "may be RO in containers". | πŸ”΄ CRITICAL | local/recipes/system/thermald/source/src/main.rs:348-358; local/recipes/system/cpufreqd/source/src/main.rs (no scheme server) | -| **G-A3** | pciehp/AER FIFO rollover can lose events silently. pcid's `EventLog` is a capped VecDeque (MAX_EVENTS=64, FIFO eviction); events arriving while the manager is slow consume the queue. Combined with G-A1's broken dedup, both producer and consumer have correctness bugs. | 🟑 HIGH | local/sources/base/drivers/pcid/src/events.rs:27, :64-68 | -| **G-A4** | redbear-iwlwifi spawned-mode contract not actually channel-based. The plan claims iwlwifi honors `PCID_CLIENT_CHANNEL` (v3.1 LDR-3), but `redbear-iwlwifi/source/src/main.rs:257` reads `PCID_DEVICE_PATH` (the legacy pcid-spawner contract), not `PCID_CLIENT_CHANNEL`. The `--daemon` mode invokes the legacy code path. The fix per the plan Β§ LDR-2 should consume the channel FD via `pcid_interface::PciFunctionHandle::connect_default()`, matching virtio-netd, e1000d, etc. | 🟑 HIGH | local/recipes/drivers/redbear-iwlwifi/source/src/main.rs:257 | -| **G-A5** | driver-manager restart re-applies recovery actions. `last_seen` in unified_events.rs is in-process state. If driver-manager restarts (SIGHUP, crash, manual restart), `last_seen = 0` and the entire accumulated log re-fires β€” `RecoveryAction::ResetDevice` for NonFatal events and `RecoveryAction::RescanBus` for Fatal events are applied to already-recovered devices. | 🟑 HIGH | driver-manager/src/unified_events.rs:76-77 | +| **G-A1** | AER/pciehp hash-deduplication is order-dependent and unreliable. `aer.rs::stable_hash + last_seen: u64` with `key > *last_seen` deduplication is broken: events with hashes below `last_seen` are silently dropped on every poll, snapshots can re-process the same events if pcid reorders them, and the dedup state is per-process (lost on every restart β€” driver-manager restart can replay RecoveryAction::ResetDevice/RescanBus on already-recovered devices). | πŸ”΄ CRITICAL | βœ… **FIXED v4.9/v5.0** β€” seq-based dedup with persistent state | +| **G-A2** | cpufreqd/thermald integration broken. thermald tries to switch the governor by writing `/scheme/cpufreq/governor` (main.rs:38, :348-358); cpufreqd only writes `/scheme/cpufreq/state` (cpufreqd/src/main.rs:306) and provides no SchemeSync implementation. No daemon registers `cpufreq` as a scheme. thermald's `set_cpufreq_governor` therefore always returns `Ok(false)` (path.exists() is false) β€” passive cooling cannot actually switch the governor. redbear-power's cpufreq.rs:187 acknowledges this with "may be RO in containers". | πŸ”΄ CRITICAL | βœ… **FIXED v4.9/v5.1** β€” cpufreqd provides real `cpufreq` scheme | +| **G-A3** | pciehp/AER FIFO rollover can lose events silently. pcid's `EventLog` is a capped VecDeque (MAX_EVENTS=64, FIFO eviction); events arriving while the manager is slow consume the queue. Combined with G-A1's broken dedup, both producer and consumer have correctness bugs. | 🟑 HIGH | βœ… **FIXED v4.9/v5.0** β€” MAX_EVENTS raised to 256; high_water_mark tracks highest seq ever issued | +| **G-A4** | redbear-iwlwifi spawned-mode contract not actually channel-based. The plan claims iwlwifi honors `PCID_CLIENT_CHANNEL` (v3.1 LDR-3), but `redbear-iwlwifi/source/src/main.rs:257` reads `PCID_DEVICE_PATH` (the legacy pcid-spawner contract), not `PCID_CLIENT_CHANNEL`. The `--daemon` mode invokes the legacy code path. The fix per the plan Β§ LDR-2 should consume the channel FD via `pcid_interface::PciFunctionHandle::connect_default()`, matching virtio-netd, e1000d, etc. | 🟑 HIGH | πŸ”΄ **DEFERRED** β€” operator working on iwlwifi separately; do not touch in this session | +| **G-A5** | driver-manager restart re-applies recovery actions. `last_seen` in unified_events.rs is in-process state. If driver-manager restarts (SIGHUP, crash, manual restart), `last_seen = 0` and the entire accumulated log re-fires β€” `RecoveryAction::ResetDevice` for NonFatal events and `RecoveryAction::RescanBus` for Fatal events are applied to already-recovered devices. | 🟑 HIGH | βœ… **FIXED v4.9/v5.0** β€” persistent seq state at `/var/run/driver-manager/event-seqs.json` | -### Adjacent-tech compatibility matrix (v4.8) +### Adjacent-tech compatibility matrix (v4.9) -| Adjacent | Compatibility | v4.8 notes | +| Adjacent | v4.8 status | v4.9 status | |---|---|---| -| cpufreqd | πŸ”΄ broken | Provides no scheme. thermald cannot switch governor. **Fix per G-A2.** | -| thermald | 🟑 partially broken | Reads `/scheme/thermal/`, writes `/scheme/cpufreq/governor` (broken). MSR 0x19C and 0x1A2 read paths look correct. | -| coretempd | βœ… compatible | Separate from cpufreq/thermal; reads its own data sources. No driver-manager dependency. | -| iommu | βœ… compatible | `iommu_group_env_value` correctly returns "0" on absent scheme (v4.4). pcid_io port fix (P1-pci-open-io-ports-iopl.patch) is in place. | -| numad | βœ… compatible | `numa_node_env_value` uses scheme-presence detection. No driver-manager dependency needed. | -| udev-shim | βœ… reads driver-manager | `/scheme/driver-manager/bound` β†’ DRIVER= uevent property is wired. | -| driver-params | βœ… reads driver-manager | `/scheme/driver-manager/bound` β†’ per-driver param surface (line 537). | -| redox-drm | βœ… uses pcid_interface | Spawned by driver-manager via channel handoff. Per-driver spawning not verified for `--daemon` paths. | -| xhcid / ehcid / ohcid / uhcid | βœ… uses pcid_interface | Standard channel contract. | -| virtio-netd | βœ… uses pcid_interface | Standard channel contract (uses `pcid_interface::pci_daemon`). | -| redbear-iwlwifi | 🟑 legacy path | Per G-A4: spawn contract is `PCID_DEVICE_PATH`, not `PCID_CLIENT_CHANNEL`. | -| amdgpu | βœ… in-process via redox-drm FFI | Not separately spawned by driver-manager; loaded in-process by redox-drm via FFI. | -| acpid | βœ… scheme | `pci_fd` registration is fixed (v4.2). RSDP/AML bootstrap works for modern AMD. | -| firmware-loader | βœ… scheme | `/scheme/firmware/` serves blobs. NEED_FIRMWARE quirk flag triggers deferred-retry waiting for the scheme to register. | -| redbear-sessiond | βœ… D-Bus only | org.freedesktop.login1 subset. No direct driver-manager coupling. | -| evdevd | βœ… reads driver-manager | `requires_weak = ["00_driver-manager.service"]` (config/redbear-device-services.toml:823). | -| inputd (base) | βœ… base-package | multiplexes input from multiple drivers. Not driven by driver-manager. | -| pcid | βœ… producers | `events.rs` AER/pciehp poller runs at 500ms. `/scheme/pci/aer`, `/scheme/pci/pciehp` exposed. **Producer FIFO rollover per G-A3.** | +| cpufreqd | πŸ”΄ broken | βœ… **FIXED** β€” real `cpufreq` scheme server. Governor switching works. | +| thermald | 🟑 partially broken | βœ… **FIXED** β€” `set_cpufreq_governor` now actually switches governor | +| coretempd | βœ… compatible | βœ… compatible | +| iommu | βœ… compatible | βœ… compatible | +| numad | βœ… compatible | βœ… compatible | +| udev-shim | βœ… reads driver-manager | βœ… reads driver-manager | +| driver-params | βœ… reads driver-manager | βœ… reads driver-manager | +| redox-drm | βœ… uses pcid_interface | βœ… uses pcid_interface | +| xhcid / ehcid / ohcid / uhcid | βœ… uses pcid_interface | βœ… uses pcid_interface | +| virtio-netd | βœ… uses pcid_interface | βœ… uses pcid_interface | +| redbear-iwlwifi | 🟑 legacy path | 🟑 legacy path (**deferred** β€” see G-A4) | +| amdgpu | βœ… in-process via redox-drm FFI | βœ… in-process via redox-drm FFI | +| acpid | βœ… scheme | βœ… scheme | +| firmware-loader | βœ… scheme + v5.5 timing | βœ… scheme + v5.5 timing bucket | +| redbear-sessiond | βœ… D-Bus only | βœ… D-Bus only | +| evdevd | βœ… reads driver-manager | βœ… reads driver-manager | +| pcid | βœ… producers (FIFO rollover per G-A3) | βœ… seq-numbered events; `/scheme/pci/aer_seq` and `/scheme/pci/pciehp_seq` endpoints | -### Boot race conditions (v4.8) +### Boot race conditions (v4.8/v4.9) Documented in companion doc `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md` Β§ "Problem restated (precisely)" and `local/docs/SYSTEM-STABILITY-AND-UPSTREAM-SYNC-PLAN.md` Β§ "Stall-on-openat". The race surfaces at boot-time provider daemons (e.g. ahcid, xhcid, redox-drm) when initnsmgr's single-threaded event loop -proxies path resolution. The key races affecting driver-manager: +proxies path resolution. -| Race | Where it surfaces | Driver-manager consequence | -|---|---|---| -| **Head-of-line block** | `initnsmgr` openat β†’ `open_scheme_resource` blocks behind one slow provider | Driver-manager's `--initfs` mode can stall at the storage driver claim, blocking subsequent driver claims behind it | -| **pcid producer race** | pcid AER/pciehp poller at 500ms cadence; driver-manager consumer at 500ms cadence | Aligned by chance; events can be missed if consumer sleeps late | -| **Firmware-load race** | driver-manager claims a device whose quirk says `NEED_FIRMWARE` before firmware-loader has registered `/scheme/firmware/` | Driver enters Deferred retry; eventually resolves (or 30Γ—500ms retry limit) | -| **acpid/aml race** | driver-manager boots before acpid AML symbol cache is warm | Boot continues (acpid register-on-sendfd accepts replacement); no driver-manager consequence | -| **iopl race** | driver-manager claims a PCI device whose driver needs I/O port access (legacy `pci_request_regions` analog) before P1-pci-open-io-ports-iopl.patch is registered | Driver probe fails; goes to deferred retry; eventually succeeds after pcid registers iopl | +**v4.9 instrumentation** (v5.5): driver-manager now measures and exposes: +- **claim-spawn latency** per device (probe β†’ child ready) +- **firmware-ready latency** for NEED_FIRMWARE drivers (quirk consultation β†’ scheme registered) +- **governor-switch latency** (cpufreqd writes `/scheme/cpufreq/governor` β†’ main loop applies) β€” **now measurable since v5.1 wired cpufreqd** +- **aer-event latency** (pcid poll β†’ driver-manager consume, via pcid's `ts=` field) -**Documented initnsmgr concurrency design** (per Design B in +Surface at `/scheme/driver-manager/timing` (read-only JSON) and append to +`/tmp/redbear-boot-timeline.json`. See `local/recipes/system/driver-manager/source/src/timing.rs`. + +The initnsmgr concurrency design (per Design B in `INITNSMGR-CONCURRENCY-DESIGN.md`): kernel `O_NONBLOCK` on open + single-thread deferred; reuse the RawEventQueue pattern acpid already runs; activate fbcond's existing retry. Step 1 (`Arc>`) is a strict @@ -100,17 +110,17 @@ end-state once a freestanding thread-spawn helper is added to `redox_rt`. | v3.1 status "Open items: P0-4 QEMU runtime gate (build running; first boot with driver-manager owning the path), P2-1 pcid producers (AER registers, pciehp slot events), P3 policy/hygiene" | P0-4 PASSED (v3.2). P2-1 PARTIAL β€” AER/pciehp producers now exist in pcid but consumer dedup is broken per G-A1. P3 is closed. | | v3.0 corrections table rows 1-5 | All corrections applied in v3.1-v3.2; the table is historical context, not actionable. Keep for traceability; mark as closed. | -### v5.x work program (new in v4.8) +### v5.x work program (v4.8 / updated v4.9) -| Track | Item | Goal | -|---|---|---| -| **v5.0** | **Fix AER/pciehp dedup** (G-A1, G-A3, G-A5) | Replace `last_seen: u64 + stable_hash > last_seen` with monotonic sequence number from pcid producer (preferred) or per-event `BTreeSet` of seen hashes (fallback). Fix pcid FIFO rollover to never silently drop events (ring buffer with overflow marker, or have pcid grow the buffer to MAX_EVENTS*2 on demand). Persist `last_seen` to disk on shutdown for clean restart. | -| **v5.1** | **Fix cpufreq/thermald integration** (G-A2) | cpufreqd MUST provide a real SchemeSync impl registering `cpufreq` scheme, exposing `/scheme/cpufreq/governor` (writable), `/scheme/cpufreq/cpu/scaling_governor` (writable, per-CPU), `/scheme/cpufreq/state` (read-only, current governor + state), and the Linux-style per-policy directories. thermald already writes the right paths. | -| **v5.2** | **Fix redbear-iwlwifi spawned-mode contract** (G-A4) | iwlwifi must consume `PCID_CLIENT_CHANNEL` (the standard pcid_interface contract), wrap it via `PciFunctionHandle::connect_default()`, and fall back to `PCID_DEVICE_PATH` only for the legacy manual-probe CLI mode. Match the contract every other PCI driver (virtio-netd, e1000d, etc.) uses. | -| **v5.3** | **initnsmgr head-of-line fix** | Implement Design B (kernel `O_NONBLOCK` on open + single-thread deferred). Activate fbcond's existing retry. Re-evaluate Design A only after `redox_rt` grows a freestanding thread-spawn helper. | -| **v5.4** | **Driver-level `Driver::on_error` adoption** | Roll out the IPC layer (linux-kpi `pci_register_error_handler` callable per v4.6 contract tests) to redbear-iwlwifi (when Rust port lands), and the next wifi driver family. Per-device recovery decisions improve AER outcomes. | -| **v5.5** | **Boot race instrumentation** | Add boot-timeline instrumentation for: (a) driver-manager claim-to-spawn latency per device; (b) firmware-loader ready-to-driver-bind latency for `NEED_FIRMWARE` drivers; (c) thermald governor-switch latency; (d) pcid AER event latency (pollerβ†’consumer). Surface as `/scheme/driver-manager/timing` and `/tmp/redbear-boot-timeline.json` extensions. | -| **v5.6** | **Hardware validation matrix completion** | AMD Threadripper (canonical AMD profile), Intel Alder Lake or later, with β‰₯3 driver categories each: storage (NVMe + AHCI), network (e1000d + rtl8168d + virtio-netd), USB (xhcid), GPU (Intel or AMD display path). Per `local/docs/HARDWARE-VALIDATION-MATRIX.md`. | +| Track | Item | Goal | v4.9 status | +|---|---|---|---| +| **v5.0** | **Fix AER/pciehp dedup** (G-A1, G-A3, G-A5) | Replace `last_seen: u64 + stable_hash > last_seen` with monotonic sequence number from pcid producer (preferred) or per-event `BTreeSet` of seen hashes (fallback). Fix pcid FIFO rollover to never silently drop events (ring buffer with overflow marker, or have pcid grow the buffer to MAX_EVENTS*2 on demand). Persist `last_seen` to disk on shutdown for clean restart. | βœ… **DONE 2026-07-25** β€” commit `cd26a6453e`. Monotonic seq from pcid (`d98330a7` on submodule/base), MAX_EVENTS=256, atomic-rename persistence at `/var/run/driver-manager/event-seqs.json`. 16 new tests, 88 total passing. | +| **v5.1** | **Fix cpufreq/thermald integration** (G-A2) | cpufreqd MUST provide a real SchemeSync impl registering `cpufreq` scheme, exposing `/scheme/cpufreq/governor` (writable), `/scheme/cpufreq/cpu/scaling_governor` (writable, per-CPU), `/scheme/cpufreq/state` (read-only, current governor + state), and the Linux-style per-policy directories. thermald already writes the right paths. | βœ… **DONE 2026-07-25** β€” commit `8157eda85f`. cpufreqd registers `cpufreq` scheme, exposes 11 paths including `governor`, `cpu/scaling_governor` (rw), `state` (ro), and `control/governor` (rw alias). 21 new tests, all passing. | +| **v5.2** | **Fix redbear-iwlwifi spawned-mode contract** (G-A4) | iwlwifi must consume `PCID_CLIENT_CHANNEL` (the standard pcid_interface contract), wrap it via `PciFunctionHandle::connect_default()`, and fall back to `PCID_DEVICE_PATH` only for the legacy manual-probe CLI mode. Match the contract every other PCI driver (virtio-netd, e1000d, etc.) uses. | πŸ”΄ **DEFERRED** β€” operator instruction 2026-07-25: "do not touch redbear-iwlwifi here. working on it elsewhere." Documented as G-A4-OPEN. | +| **v5.3** | **initnsmgr head-of-line fix** | Implement Design B (kernel `O_NONBLOCK` on open + single-thread deferred). Activate fbcond's existing retry. Re-evaluate Design A only after `redox_rt` grows a freestanding thread-spawn helper. | 🟑 **DESIGN COMPLETE** β€” `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md` records Design B as the recommended first step. Implementation pending kernel change with system-wide blast radius; needs idle-host validation. | +| **v5.4** | **Driver-level `Driver::on_error` adoption** | Roll out the IPC layer (linux-kpi `pci_register_error_handler` callable per v4.6 contract tests) to redbear-iwlwifi (when Rust port lands), and the next wifi driver family. Per-device recovery decisions improve AER outcomes. | 🟑 **IPC LAYER IN PLACE** β€” `pci_register_error_handler` (linux-kpi) is contract-tested per v4.6 (3 tests). No shipped driver daemon opts in yet; rollout awaiting first wifi driver Rust port. | +| **v5.5** | **Boot race instrumentation** | Add boot-timeline instrumentation for: (a) driver-manager claim-to-spawn latency per device; (b) firmware-loader ready-to-driver-bind latency for `NEED_FIRMWARE` drivers; (c) thermald governor-switch latency; (d) pcid AER event latency (pollerβ†’consumer). Surface as `/scheme/driver-manager/timing` and `/tmp/redbear-boot-timeline.json` extensions. | βœ… **DONE 2026-07-25** β€” commit `045aaa4579`. New `timing.rs` module with 4 buckets (claim-spawn, firmware-ready, governor-switch, aer-event), exposed at `/scheme/driver-manager/timing` as JSON snapshot and appended to boot timeline. 24 new tests, 112 total passing. | +| **v5.6** | **Hardware validation matrix completion** | AMD Threadripper (canonical AMD profile), Intel Alder Lake or later, with β‰₯3 driver categories each: storage (NVMe + AHCI), network (e1000d + rtl8168d + virtio-netd), USB (xhcid), GPU (Intel or AMD display path). Per `local/docs/HARDWARE-VALIDATION-MATRIX.md`. | πŸ”΄ **OPERATOR-ONLY** β€” D5 ratification gate. No agent can perform real-hardware validation. Status unchanged from v4.7. | ### Comprehensive driver inventory (v4.8) @@ -216,33 +226,59 @@ regression test in `local/recipes/system/driver-manager/source/src/config.rs:84` - **No `modprobe.d options` parser yet** β€” that's a v5.x work item, not a v4.8 change. -### Verification gate for v4.8 +### Verification gate for v4.9 | Gate | Status | Evidence | |---|---|---| | 0-warning host compile | βœ… | `cargo check` clean | -| 0-warning Redox target compile | βœ… | `repo cook driver-manager` clean (v4.5) | -| Tests pass | βœ… | 94 + 9 (v4.7) + 3 (v4.6 contract) = 106 tests, all passing | +| 0-warning Redox target compile | βœ… | `cargo check --target x86_64-unknown-redox` clean (driver-manager + cpufreqd + pcid) | +| Tests pass | βœ… | **driver-manager**: 112 (88 v5.0 + 24 v5.5); **cpufreqd**: 21 (v5.1); **all green** | | QEMU runtime gate | βœ… | v3.2 PASSED (q35, e1000 + AHCI topology, initfs ahcid bind β†’ switchroot β†’ rootfs e1000d concurrent bind) | -| Adjacent-tech audit | βœ… | This v4.8 update | +| Adjacent-tech audit | βœ… | This v4.9 update; G-A2 closed by v5.1 | | Boot-race analysis | βœ… | INITNSMGR-CONCURRENCY-DESIGN.md Β§"Problem restated" + this Β§"Boot race conditions" | -| Linux 7.1 / CachyOS cross-ref | βœ… | This v4.8 update | +| Boot-race instrumentation | βœ… | v5.5 `/scheme/driver-manager/timing` JSON endpoint + boot-timeline extension | +| AER/pciehp dedup correctness | βœ… | v5.0 seq-based dedup; persistent seq state survives restart | +| cpufreqd/thermald integration | βœ… | v5.1 real cpufreq scheme; governor switch end-to-end | +| Linux 7.1 / CachyOS cross-ref | βœ… | v4.8 update (C13 AER partial - 4-state vs 6-state; C14 pciehp partial - 4 of 5 hardware bits; modprobe.d options not yet implemented) | | Hardware validation matrix | πŸ”΄ open | D5 ratification gate β€” operator-only work | | Two-week soak + 3 bare-metal reboots | πŸ”΄ open | C4 ratification gate β€” operator-only work | -### File location of all v4.8 deliverables +### File location of all v4.9 deliverables -| Deliverable | Path | -|---|---| -| Comprehensive assessment (this section) | `local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md` (v4.8) | -| v4.7 hid-core parser tests | `local/recipes/drivers/redbear-hid-core/source/src/parser.rs` | -| v4.6 contract tests | `local/recipes/drivers/linux-kpi/source/src/rust_impl/error.rs::tests` | -| Companion boot-race docs | `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md`, `local/docs/INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md`, `local/docs/SYSTEM-STABILITY-AND-UPSTREAM-SYNC-PLAN.md` | -| Companion evidence | `local/docs/evidence/driver-manager/ASSESSMENT-2026-07-22.md`, `local/docs/evidence/driver-manager/D5-AUDIT.md` | -| Driver match tables | `local/config/drivers.d/*.toml` (9 files) | -| Policy package | `local/recipes/system/redbear-driver-policy/source/policy/` | -| Audit script | `local/scripts/driver-manager-audit-no-stubs.py` | -| Test scripts | `local/scripts/test-driver-manager-{cutover,hotplug,initfs,active,parity,pm,no-stubs-qemu}.sh` | +| Deliverable | Path | Commit | +|---|---|---| +| Comprehensive assessment (this section) | `local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md` (v4.9) | (this update) | +| **v5.0: AER/pciehp seq-based dedup + persistence** | | | +| driver-manager seq-based dedup | `local/recipes/system/driver-manager/source/src/aer.rs`, `pciehp.rs`, `unified_events.rs` | `cd26a6453e` | +| pcid seq producer + endpoints | `local/sources/base/drivers/pcid/src/events.rs`, `scheme.rs` | `d98330a7` on `submodule/base` | +| **v5.1: cpufreqd scheme server** | | | +| cpufreq scheme.rs (new) | `local/recipes/system/cpufreqd/source/src/scheme.rs` | `8157eda85f` | +| cpufreqd main + Cargo | `local/recipes/system/cpufreqd/source/src/main.rs`, `Cargo.toml` | `8157eda85f` | +| **v5.5: Boot race instrumentation** | | | +| driver-manager timing.rs (new) | `local/recipes/system/driver-manager/source/src/timing.rs` | `045aaa4579` | +| driver-manager wiring | `local/recipes/system/driver-manager/source/src/config.rs`, `main.rs`, `scheme.rs`, `unified_events.rs` | `045aaa4579` | +| **Deferred (G-A4)** | | | +| redbear-iwlwifi spawned-mode | `local/recipes/drivers/redbear-iwlwifi/` (NOT TOUCHED in this session) | β€” | +| Companion docs | `local/docs/INITNSMGR-CONCURRENCY-DESIGN.md`, `local/docs/INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md`, `local/docs/SYSTEM-STABILITY-AND-UPSTREAM-SYNC-PLAN.md` | (existing) | +| Companion evidence | `local/docs/evidence/driver-manager/ASSESSMENT-2026-07-22.md`, `local/docs/evidence/driver-manager/D5-AUDIT.md` | (existing) | +| Driver match tables | `local/config/drivers.d/*.toml` (9 files) | (existing) | +| Policy package | `local/recipes/system/redbear-driver-policy/source/policy/` | (existing) | +| Audit script | `local/scripts/driver-manager-audit-no-stubs.py` | (existing) | +| Test scripts | `local/scripts/test-driver-manager-{cutover,hotplug,initfs,active,parity,pm,no-stubs-qemu}.sh` | (existing) | + +### Commit timeline for v4.9 work session (2026-07-25) + +| Commit | Hash | Subject | +|---|---|---| +| 1 | `917774776a` | docs(driver-manager): v4.8 post-cutover comprehensive audit | +| 2 | `cd26a6453e` | v5.0: AER/pciehp seq-based dedup + persistent restart state | +| 3 | `045aaa4579` | v5.5: boot race instrumentation - claim/firmware/aer latency buckets | +| 4 | `8157eda85f` | v5.1: cpufreqd scheme server - real cpufreq scheme, no more stub | +| 5 | (this commit) | docs(driver-manager): v4.9 records v5.0/v5.1/v5.5 implementation | + +The order was: v4.8 plan β†’ v5.0 (driver-manager + pcid) β†’ v5.5 (driver-manager) β†’ +v5.1 (cpufreqd) β†’ v4.9 plan. v5.2 (iwlwifi) deferred per operator instruction +("do not touch redbear-iwlwifi here. working on it elsewhere"). **Toolchain:** Rust nightly-2026-05-24 (edition 2024) **Architecture:** Microkernel OS in Rust (Redox fork) **Cross-reference baseline:** Linux kernel 7.1 at commit `ab9de95c9` (`local/reference/linux-7.1/`), CachyOS (`local/reference/cachyos/` β€” linux-cachyos `0001-cachyos-base-all.patch` 6.17.9 + desktop ISO 260628)