driver-manager: v3.1 — implementation + cutover documented, services integration assessed

Plan v3.1 records the completed P0/LDR/P2 work program and the operator-ratified cutover (driver-manager owns the boot path in all redbear-* configs; pcid-spawner gated as fallback). Assessment § 11 documents the OS-services integration: init ConditionPathExists gate, live driver-params bridge, udev-shim driver-binding gap (P3), and the correct absence of D-Bus (bridge-on-demand pattern).
2026-07-23 18:08:03 +09:00
parent b338760111
commit 884f9e8e0d
2 changed files with 79 additions and 2 deletions
@@ -1,11 +1,69 @@
 # Red Bear OS — `pci-spawner` → `driver-manager` Migration Plan

-**Document status:** v3.0 canonical planning authority (supersedes v2.2 with the 2026-07-22 major assessment: runtime blocker on the `/bind` claim, the linux-kpi claim-system split, inert pciehp/AER listeners, and the Linux-Driver-Reuse track that aligns the whole plan with the project's critical goal — reusing Linux drivers)
+**Document status:** v3.1 canonical planning authority (supersedes v3.0 with the completed P0/LDR/P2 implementation and the operator-ratified cutover: driver-manager now owns the boot path in all `redbear-*` configs; pcid-spawner is gated as the fallback)
 **Generated:** 2026-07-20
 **Toolchain:** Rust nightly-2026-05-24 (edition 2024)
 **Architecture:** Microkernel OS in Rust (Redox fork)
 **Cross-reference baseline:** Linux kernel 7.1 at commit `ab9de95c9` (`local/reference/linux-7.1/`), CachyOS (`local/reference/cachyos/` — linux-cachyos `0001-cachyos-base-all.patch` 6.17.9 + desktop ISO 260628)
-**Assessment:** `local/docs/evidence/driver-manager/ASSESSMENT-2026-07-22.md` (findings register B1–G10)
+**Assessment:** `local/docs/evidence/driver-manager/ASSESSMENT-2026-07-22.md` (findings B1–G10, § 11 services integration)
+
+**v3.1 status update over v3.0 (implementation + cutover round, 2026-07-23):**
+
+The v3.0 work program is implemented and the operator has ratified the
+cutover: **driver-manager owns the boot path in every `redbear-*`
+config; pcid-spawner is retired from configs and gated behind
+`/etc/driver-manager.d/disabled` as the operator fallback (never
+deleted).** Future OS development is based on driver-manager.
+
+Completed items:
+
+- **P0-1 ✅ Claim-via-channel collapse.** `probe()` does a single
+  `PciFunctionHandle::connect_by_path()`; `ENOLCK` → next candidate;
+  `enable_device` + `into_inner_fd` → `PCID_CLIENT_CHANNEL`.
+  `claim_pci_device`/`open_pcid_channel` deleted; `SpawnedDriver` holds
+  the channel fd (claim lifetime == child lifetime).
+- **P0-2 ✅ Orphan patches resolved.** bind-scheme + uevent-fix moved to
+  `local/patches/legacy-superseded-2026-07-22/` with a SUPERSEDED.md
+  audit entry; aer-scheme retained as the P2-1 producer blueprint.
+- **P0-3 ✅ Advisory theater stripped.** `modern_tech.rs` and `exec.rs`
+  deleted; the useful parts correctly wired as spawn env hints
+  (`REDBEAR_DRIVER_IOMMU_GROUP` / `REDBEAR_DRIVER_NUMA_NODE` /
+  `REDBEAR_DRIVER_MSIX_VECTORS`); redox-driver-core C/P-state
+  coordinators removed (no consumers).
+- **LDR-2 ✅ Spawned-mode `pci_register_driver`.** linux-kpi honors
+  `PCID_CLIENT_CHANNEL` (probe only the granted device; never
+  enumerate). Standalone mode retained for CLI tools.
+- **LDR-3 ✅ iwlwifi onboarded.** `--daemon` mode (honors
+  `PCID_DEVICE_PATH`, full-init, resident) + `70-wifi.toml` staged;
+  `--import-linux-ids` wires linux_loader into production
+  (Linux `id_table` → `[[driver.match]]` TOML).
+- **LDR-4 ✅ Verified convergent.** redox-drm already honors the pcid
+  handoff; no changes needed.
+- **LDR-5 ✅ linux-kpi API completion.** Real MSI/MSI-X via
+  pcid_interface (vector allocation + table programming; linux-kpi owns
+  the channel in linux-kpi daemons), `pci_request_regions`,
+  `pcie_capability_read/write_*`, `pci_set_power_state` /
+  `pci_save_state` / `pci_restore_state`. C header synced.
+- **P2-2 ✅ Operator surface.** Scheme endpoints `bind`, `unbind`,
+  `new_id`, `remove_id`, `driver_override`, `rescan`; DeviceManager
+  gained Tier-1 `driver_override` precedence + `bind_device`.
+- **P2-3 ✅ Success trigger.** A successful bind immediately retries
+  deferred probes (Linux `driver_deferred_probe_trigger`), in
+  `run_enumeration` and the scheme bind handler.
+- **Cutover ✅.** init learned `ConditionPathExists` (with `!`
+  negation — the C0 dormancy was a parser-rejection accident);
+  driver-manager services run by default in init.d/init.initfs.d and
+  all `redbear-*` configs; pcid-spawner services gated to
+  `/etc/driver-manager.d/disabled`. `make lint-config` clean.
+- **Services integration ✅ (assessment § 11).** driver-params bridge
+  verified live; udev-shim driver-binding view noted as a P3 gap;
+  D-Bus correctly absent (bridge-on-demand pattern documented).
+
+Open items (unchanged): **P0-4** QEMU runtime gate (build running;
+first boot with driver-manager owning the path), **P2-1** pcid
+producers (AER registers, pciehp slot events), **P3** policy/hygiene
+(quirk phases, AER recovery actions, per-vendor firmware packaging,
+udev-shim driver-binding view, dep-crate warnings, stale-tree cleanup).

 **v3.0 status update over v2.2 (the assessment round):**

@@ -316,3 +316,22 @@ Worth stating plainly, because the register above is necessarily harsh:
  gate later than it should have — hence P0-4.

 *Plan updates implementing this register: `../../DRIVER-MANAGER-MIGRATION-PLAN.md` v3.0.*
+
+---
+
+## 11. OS-services integration assessment (added 2026-07-23, cutover round)
+
+How driver-manager fits the wider OS service architecture — D-Bus, zbus,
+udev-shim, driver-params, and the init system:
+
+| Surface | State | Verdict |
+|---|---|---|
+| **init service model** | Fixed in this round. init learned `ConditionPathExists` (with `!` negation) — the C0 dormancy was previously a parser-rejection accident. Cutover wiring: driver-manager services run by default; pcid-spawner services are gated behind `/etc/driver-manager.d/disabled` as the operator fallback. | ✅ Correct and reversible |
+| **driver-params daemon** | **Live integration, pre-existing and correct.** `driver-params` reads `/scheme/driver-manager/bound` (`read_driver_manager_bound`, tolerating ENODEV when the scheme is absent) and exposes `enabled=true` params per bound driver; driver-manager's `notify_bind` writes per-device params the other direction. | ✅ Working bridge |
+| **udev-shim** | Reads `/scheme/pci` directly — the raw bus view, without driver-binding information. On Linux, libudev exposes `DRIVER=` and driver links; post-cutover udev-shim should also read `/scheme/driver-manager/{bound,devices}` so udisks/KDE-Solid-style consumers see bindings. | 🟡 Gap (P3, non-blocking) |
+| **D-Bus / zbus** | driver-manager has no D-Bus presence, and that is **correct today**. The Linux analog: udev events feed domain daemons (udisks2, upower, NetworkManager) which own the D-Bus APIs — udev itself does not publish on the bus. Red Bear's scheme *is* the native device-event transport; a driver-manager D-Bus service now would duplicate the scheme for zero consumers. If a desktop consumer ever needs bind signals over D-Bus, the pattern is a thin zbus bridge daemon (same shape as `redbear-sessiond` for login1), not D-Bus code inside driver-manager. | ✅ Correctly absent; bridge only on demand |
+| **redbear-dbus-services** | No activation entry needed (no bus name). | ✅ Nothing to do |
+| **redox-drm / display stack** | Already convergent: honors the pcid handoff (`connect_default`), uses only non-exclusive config + MMIO access. | ✅ Verified |
+| **initfs storage path** | `40_driver-manager-initfs.service` (oneshot, `--initfs`) is default-on; pcid-spawner-initfs gated as fallback. The initfs driver-manager exits after enumeration (oneshot) — correct for the pre-switchroot phase. | ✅ Wired; first QEMU gate target |
+
+*Cutover commits: `e30f2499` (init gate), `c72d4247` (service gates), `b338760111` + parent bumps (config cutover).*