vasilito/RedBear-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Add comprehensive system assessment and improvement plan

Browse Source 
Replace 5 stale planning docs with unified assessment:
- New: COMPREHENSIVE-SYSTEM-ASSESSMENT-AND-IMPROVEMENT-PLAN.md
  (12-subsystem audit vs Linux 7.1, 6 phases of work)
- Removed: IMPLEMENTATION-MASTER-PLAN, SUBSYSTEM-ASSESSMENT-2026-05,
  SMP-BOOT-HARDENING-PLAN, CPU-DMA-IRQ-MSI-SCHEDULER-FIX-PLAN,
  COMPREHENSIVE-BOOT-IMPROVEMENT-PLAN
This commit is contained in:
Admin Pupkin
2026-05-20 13:47:25 +03:00
parent b1af8a356f
commit ae46dabeb0
6 changed files with 933 additions and 1705 deletions
Download Patch File Download Diff File Expand all files Collapse all files
local/docs/COMPREHENSIVE-BOOT-IMPROVEMENT-PLAN.md
-477
View File
@@ -1,477 +0,0 @@
# Red Bear OS Comprehensive Boot Improvement Plan
**Version**: 2.0 — 2026-05-16
**Status**: Active
**Supersedes**: `SMP-BOOT-HARDENING-PLAN.md` v1.0 (P15 section) for forward work
**Scope**: Kernel SMP, AP startup, x2APIC, per-CPU data, TLB shootdowns, IRQ routing, scheduler, userspace boot, daemon robustness, IPC hardening.
## Assessment Summary
Three parallel deep-dives completed:
1. **Kernel SMP**: 20 source files, cross-referenced with Intel SDM, AMD APM, ACPI 6.5
2. **Userspace boot**: 22 source files across init, acpid, pcid, pcid-spawner, driver-manager, IPC
3. **Modern specs**: Intel SDM Vol 3A Ch 8, AMD64 APM Vol 2 Ch 7, ACPI 6.5, Linux smpboot.c, Zircon lk_main
**Total issues: 38 kernel + 16 userspace (from v1.0) + 29 new userspace + 8 new kernel = 91 issues**
- Critical: 6 kernel + 3 userspace = 9 (original) + deferred P15-3, P15-5
- High: 9 kernel + 4 userspace = 13
- Medium: 12 kernel + 12 userspace = 24
- Low: 15 kernel + 17 userspace = 32
---
## Current State (After P17 — All Scheduler Patches Complete)
### Completed Patches
| Patch | Issue | Status |
|-------|-------|--------|
| P9-P14 | Bottlenecks #1-#7 | ✅ Per-CPU context switch, broadcast TLB, IOAPIC affinity, MCS lock, range TLB, PI, NUMA |
| P15-1 | K1: AP CPU_ID race | ✅ SeqCst fetch_add |
| P15-2 | K2: AP_READY sync | ✅ AtomicU8 trampoline + fence |
| P15-4 | K4: MCS ordering | ✅ Release/Acquire fences |
| P15-6 | U1: Init deadlock | ✅ default_dependencies=false |
| P15-7 | U2: Service timeout | ✅ poll()-based 30s timeout |
| P15-8 | U3: Cycle detection | ✅ BTreeSet visiting set |
| P15-9 | U6: /tmp creation | ✅ create_dir_all |
| P15-10 | K10: TLB range ordering | ✅ Release/Acquire stores |
| P16-1 | K39/K43/K46: SIPI timing | ✅ TSC-calibrated 10ms/200µs delays, xAPIC ICR fix, second SIPI, ESR checks |
| P16-2 | K40: ESR clear/check | ✅ ESR clear before SIPI + check after, CPU count log |
| P16-3 | MAX_CPU 128→256 | ✅ Supports 256 CPUs |
| P16-4 | MADT validation | ✅ SDT checksum, MADT validation, duplicate APIC ID detection |
| P17-2 | K5: Transitive PI | ✅ Chain following via waiting_on_lock, MAX_PI_CHAIN_DEPTH=8, cycle detection |
| P17-4 | Preemption interval | ✅ Per-CPU configurable preempt_interval, default 3 ticks ≈ 6.75ms |
| P17-3 | CPU Affinity syscalls | ✅ SYS_SCHED_SETAFFINITY/GETAFFINITY (987/988), pid=0 support, RawMask-based |
| P17-1/5 | NUMA-aware selection | ✅ Same-node preference in select_next_context(), cross-node fallback |
| P18-1 | U4: Daemon restart | ✅ RestartPolicy (Never/OnFailure/Always), exponential backoff 1s→30s, max 3 restarts |
| P18-5 | U17: ACPID robustness | ✅ RSDP BIOS-area fallback, graceful physmem error handling (no panics) |
| P18-7 | U39: SIGTERM handling | ✅ driver-manager SIGTERM handler with graceful shutdown |
| P18-2 | U5: Process monitoring | ✅ reap_exited_children() in driver-manager, non-blocking waitpid |
| P18-3 | U27: MSI/MSI-X | ✅ MSI detect+log, keep legacy IRQ as baseline for all devices (v2) |
### Deferred from P15
| Patch | Issue | Reason |
|-------|-------|--------|
| P15-3 | K3: TLB shootdown range race | Needs PercpuBlock refactor — range packing into AtomicU64 |
| P15-5 | K8: NUMA node before CPU visible | Needs understanding of GDT/startup ordering |
---
## New Findings (This Assessment)
### New Kernel Issues
| # | Severity | Issue | File | Detail |
|---|----------|-------|------|--------|
| K39 | High | xAPIC path has NO delay between INIT and first SIPI | `madt/arch/x86.rs:195-218` | Intel SDM requires 10ms. Only x2APIC path has spin-count delays. xAPIC path sends INIT then immediately sends SIPI. |
| K40 | Medium | No ESR clear/check during AP startup | `madt/arch/x86.rs` | `esr()` method exists in local_apic.rs but never called during AP bringup. Intel SDM: clear ESR before SIPI, read after to verify acceptance. |
| K41 | Low | Sequential AP startup only | `madt/arch/x86.rs` | Linux does parallel bringup for 96+ cores. Current code starts APs one-by-one. |
| K42 | Low | No cpu_callout_mask / cpu_callin_mask handshake | `madt/arch/x86.rs` | Linux uses two-phase handshake for AP validation. Current code uses AP_READY bool only. |
| K43 | Medium | xAPIC SIPI has spurious bit 14 (Level=Assert) | `madt/arch/x86.rs:209` | ICR value 0x4600 has bit 14 set. Per Intel SDM, this bit is reserved/zero for SIPI. Works in QEMU but may cause issues on real hardware. |
| K44 | Low | No self-IPI MSR optimization | `local_apic.rs` | Self-IPI via MSR 0x83F is the fastest single-IPI path for x2APIC. Not implemented. |
| K45 | Low | No CPUID topology detection for AMD | `local_apic.rs` | CPUID leaf 0x8000001E for AMD topology (ext_apic_id, core_id, node_id) not used. |
| K46 | Low | xAPIC path missing second SIPI | `madt/arch/x86.rs:206-218` | Only x2APIC path sends second SIPI. Intel SDM recommends sending SIPI twice for compatibility. |
### New Userspace Issues
#### ACPID (8 issues)
| # | Severity | Issue | File | Detail |
|---|----------|-------|------|--------|
| U17 | High | AML panic on missing RSDP_ADDR | `acpid/src/acpi.rs` | Panics instead of graceful fallback when env var absent |
| U18 | Medium | Single PCI fd limitation | `acpid/src/main.rs` | Multi-segment PCIe systems can't work with single fd |
| U19 | Medium | No physmap bounds checking | `acpid/src/aml_physmem.rs` | Crafted ACPI table could cause kernel panic via unbounded physmap |
| U20 | Low | EC timeout 10ms may be insufficient | `acpid/src/ec.rs` | Slow embedded controllers need more time |
| U21 | Low | No S4 (hibernate) support | `acpid/src/acpi.rs` | S5 (shutdown) only |
| U22 | Low | Battery assumes single battery | `acpid/src/scheme.rs` | Multiple battery methods would need array |
| U35 | Medium | Page cache unbounded growth | `acpid/src/scheme.rs` | No LRU or eviction on ACPI table cache |
| U36 | Low | No FD limit on sendfd | `acpid/src/scheme.rs` | Could exhaust kernel FD table |
#### PCID (6 issues)
| # | Severity | Issue | File | Detail |
|---|----------|-------|------|--------|
| U23 | Low | No Type 2 CardBus bridge support | `pcid/src/main.rs` | Only Type 0/1 PCI headers parsed |
| U24 | Medium | Hardcoded bus 0x80 scan workaround | `pcid/src/main.rs` | Arrow Lake-specific, not portable |
| U25 | Medium | Multi-segment ECAM not implemented | `pcid/src/cfg_access/mod.rs` | Skips non-zero segment groups |
| U26 | Medium | Single global PCI mutex | `pcid/src/scheme.rs` | Serializes all PCI config access |
| U27 | High | MSI/MSI-X never enabled | `pcid/src/main.rs` | Code only disables MSI/MSI-X, never enables for drivers |
| U28 | High | Hardcoded IRQ line 9 | `pcid/src/main.rs` | All non-MSI devices get IRQ 9 regardless of actual routing |
#### Driver Manager (4 issues)
| # | Severity | Issue | File | Detail |
|---|----------|-------|------|--------|
| U29 | High | Race with legacy pcid-spawner | `driver-manager` | Both enumerate PCI and spawn drivers simultaneously |
| U30 | Low | Different retry limits (30 vs 5) | `driver-manager` | 30 for init, 5 for hotplug — no justification documented |
| U31 | Medium | No hotplug for ACPI devices | `driver-manager/src/hotplug.rs` | PCI hotplug only |
| U32 | Medium | Poll-based hotplug inefficient | `driver-manager/src/hotplug.rs` | 2s poll interval instead of event-driven |
#### IPC/Scheme (4 issues)
| # | Severity | Issue | File | Detail |
|---|----------|-------|------|--------|
| U33 | High | No scheme authentication | `ipcd` | Anyone can register any scheme name |
| U34 | Medium | No scheme conflict detection | `ipcd` | No check for duplicate registration |
| U37 | Low | SO_PEERCRED stale after exec | `ipcd/src/uds/stream.rs` | Credentials may be outdated |
| U38 | Low | No FD limit on sendfd | IPC | Kernel FD table exhaustion possible |
#### Daemon Robustness (7 issues)
| # | Severity | Issue | Detail |
|---|----------|-------|--------|
| U39 | High | No SIGTERM handling | No daemon handles SIGTERM for graceful shutdown |
| U40 | Medium | No SIGCHLD handling | Abnormal child exits not detected |
| U41 | High | No watchdog/health monitoring | No health-check ping for critical services |
| U42 | Medium | unwrap()/expect() in critical paths | Multiple panics instead of graceful degradation |
| U43 | Medium | No rollback on rootfs switch failure | Boot continues in undefined state |
| U44 | Low | No boot milestone tracking | No checkpoint/restart capability |
| U45 | Low | Low batch size (50) | Modern systems have 100+ devices |
---
## Improvement Plan — Patch Series
### Phase 1: Stabilize SMP Boot (P16) — 6 patches
**Goal**: Make AP startup reliable on real hardware with calibrated timing, error checking, and firmware bug detection.
#### P16-1: TSC-Calibrated SIPI Delays (High K7, K39, K43, K46)
**Files**: `src/acpi/madt/arch/x86.rs`
**Changes**:
1. Add `udelay(us: u64)` function using TSC (read via `rdtsc`, calibrated from `cpu_khz` if available, else use known CPU frequency). For early boot before TSC calibration, use a conservative spin loop.
2. **xAPIC path** (currently no delay):
- After INIT IPI: `udelay(10_000)` (10ms per Intel SDM)
- After SIPI #1: `udelay(200)` (200µs)
- Send SIPI #2 (currently missing)
- After SIPI #2: `udelay(200)` (200µs)
3. **x2APIC path** (currently spin-count delays):
- Replace `for _ in 0..100_000 { spin_loop() }` with `udelay(10_000)` (10ms)
- Replace `for _ in 0..2_000_000 { spin_loop() }` with `udelay(200)` (200µs)
4. Fix xAPIC SIPI ICR: change `0x4600` to `0x0600` (remove spurious bit 14 Assert)
**Early-boot TSC strategy**: At AP startup time, the kernel has already calibrated the TSC (it's needed for the scheduler timer). Use `crate::time::monotonic()` or direct `rdtsc` with the known CPU frequency. If no TSC freq is available yet, use a conservative spin loop calibrated for at least 10ms at minimum CPU speed.
**Reference**: Intel SDM Vol 3A §8.4.4, Linux `wakeup_secondary_cpu_via_init()`
#### P16-2: AP Startup ESR Check + Graceful Degradation (Medium K40)
**Files**: `src/acpi/madt/arch/x86.rs`
**Changes**:
1. Before sending INIT IPI: `local_apic.esr()` to clear ESR
2. After each SIPI: read ESR to check for delivery errors
3. If ESR indicates error after both SIPIs, log warning and skip that CPU
4. Track `cpu_online_mask` (AtomicU32 bitmap) separately from `cpu_possible_mask`
5. On timeout (trampoline or AP_READY), log which CPU failed and why, continue boot
**Code structure**: Extract the common AP startup sequence into a helper function to avoid the duplicated code between xAPIC and x2APIC paths.
#### P16-3: MAX_CPU_COUNT Increase to 256 (High K12)
**Files**: `src/cpu_set.rs`
**Changes**:
1. Change `MAX_CPU_COUNT` from 128 to 256 for 64-bit targets
2. Add boot-time log: "N CPUs detected, MAX_CPU_COUNT=256"
3. Add boot-time warning if CPU count > 200 (approaching limit)
**Impact**: SET_WORDS grows from 2 to 4 (256/64). LogicalCpuSet becomes 32 bytes instead of 16. All users are by-value or reference, so no ABI break.
#### P16-4: Firmware Bug Detection (Medium)
**Files**: `src/acpi/madt/mod.rs`, `src/acpi/mod.rs`
**Changes**:
1. **Duplicate APIC ID detection**: During MADT iteration in `arch::init()`, collect all APIC IDs in a `BTreeSet<u32>`. If duplicate found, log warning with both entries. Keep first, skip duplicates.
2. **SDT checksum validation**: In `acpi/mod.rs`, add `fn validate_sdt_checksum(sdt: &Sdt) -> bool` that sums all bytes and checks == 0. Call for MADT, SRAT, SLIT before use. Log warning and skip table if checksum fails.
3. **Unknown MADT type logging**: Already logs via `debug!` but upgrade to `info!` for unknown types. Add MADT revision check.
#### P16-5: TLB Shootdown Range Race Fix (Critical K3, deferred from P15-3)
**Files**: `src/percpu.rs`
**Changes**: Pack TLB range into a single `AtomicU64`:
- Bits [63:32] = start page (up to 2^32 pages = 16TB address space)
- Bits [31:0] = count (up to 4 billion pages)
- Single `compare_exchange` or `swap` sets the flag + range atomically
- Handler unpacks with single `load`
- If range is too large for packing, fall back to full shootdown
**Risk**: Medium. Affects all TLB shootdowns. Must verify no regressions.
#### P16-6: NUMA Node Before CPU Visible (High K8, deferred from P15-5)
**Files**: `src/acpi/madt/arch/x86.rs`
**Changes**:
1. Move `record_apic_mapping()` and `percpu.numa_node.set()` BEFORE `CPU_COUNT.fetch_add()`
2. Add `fence(SeqCst)` between them so scheduler sees NUMA data before the CPU becomes schedulable
3. This requires PercpuBlock to be allocated and initialized before the fetch_add — verify that `allocate_and_init_pcr()` and the percpu allocation happen early enough
**Risk**: Low-Medium. Reordering of operations, must verify AP startup still works.
---
### Phase 2: Desktop-Safe Scheduler (P17) — ✅ COMPLETE (6 patches)
#### P17-1: NUMA-Aware Work Stealing (Medium K20) — ✅ DONE
**Files**: `src/context/switch.rs`
**Patch**: `P17-1-numa-selection.patch`
**Change**: In `select_next_context()`, prefer contexts whose last CPU is on the same NUMA node. Two-phase selection: scan for same-node candidates first, fall back to cross-node. New contexts (no last CPU) treated as same-node. Uses `percpu.numa_node` set by P14 SRAT parsing.
#### P17-2: Transitive Priority Inheritance (Critical K5) — ✅ DONE
**Files**: `src/sync/mcs.rs`, `src/percpu.rs`
**Patches**: `P17-2a-percpu-waiting.patch`, `P17-2b-transitive-pi.patch`
**Change**: Added `waiting_on_lock: AtomicPtr<McsRawLock>` to PercpuBlock. Rewrote `maybe_donate_priority()` to follow the PI chain transitively up to `MAX_PI_CHAIN_DEPTH` (8) hops with cycle detection. Each CPU records which MCS lock it's spinning on before entering the spin loop; the donation function follows `waiting_on_lock → holder_cpu` chains to propagate priority through A→B→C nesting.
#### P17-3: CPU Affinity Syscalls (New Feature) — ✅ DONE (pid=0)
**Files**: `src/syscall/process.rs`, `src/syscall/mod.rs`
**Patches**: `P17-3-sched-affinity.patch`, `P17-3-syscall-dispatch.patch`
**Change**: Added `SYS_SCHED_SETAFFINITY` (987) and `SYS_SCHED_GETAFFINITY` (988) as local syscall constants. `sched_affinity: LogicalCpuSet` already existed on Context and was checked in `update_runnable()`. New handlers read/write `RawMask` ([usize; 4], 32 bytes) to/from userspace. Currently supports pid=0 (current process only); PID-based lookup deferred pending lock token architecture work.
#### P17-4: Configurable Preemption Interval — ✅ DONE
**Files**: `src/context/switch.rs`
**Patch**: `P17-4-configurable-preempt.patch`
**Change**: Replaced hardcoded `new_ticks >= 3` with per-CPU `preempt_interval: Cell<usize>` on `ContextSwitchPercpu`. Default: `DEFAULT_PREEMPT_INTERVAL = 3` (≈6.75 ms). Infrastructure ready for runtime tuning via syscall or kernel command line.
#### P17-5: Load Balancing — ✅ MERGED INTO P17-1
**Note**: The global run queues (shared by all CPUs) make traditional work-stealing unnecessary. The NUMA-aware selection in P17-1 effectively provides the same benefit — idle CPUs naturally pick up cross-node work when same-node work is unavailable.
---
### Phase 3: Harden Userspace Boot & IPC (P18) — 8/8 complete
#### P18-1: Daemon Restart Policy (High U4) — ✅ DONE
**Files**: `init/src/service.rs`, `scheduler.rs`, `init/src/main.rs`
**Patch**: `local/patches/base/P18-1-daemon-restart.patch`
**Status**: RestartPolicy enum (Never/OnFailure/Always), max_restarts (default 3), exponential backoff (1s→2s→4s→8s→16s, max 30s). Scheduler tracks supervised PID→ServiceState in BTreeMap. handle_child_exit() in main loop applies restart policy. Built and boot-tested on redbear-mini.
#### P18-2: Process Monitoring & Cleanup (High U5) — ✅ DONE
**Files**: `local/recipes/system/driver-manager/source/src/config.rs`, `main.rs`
**Reference Patch**: `local/patches/driver-manager/P18-2-process-monitoring.patch`
**Status**: `reap_exited_children()` method on DriverConfig — non-blocking `try_wait()` for all spawned children. `reap_all_drivers()` function polls all configs. Called in deferred retry loop and idle loop (every 5s). Exited drivers are removed from the spawned map and logged.
#### P18-3: MSI/MSI-X Enablement (High U27) — ✅ DONE (v2)
**Files**: `drivers/pcid/src/main.rs`
**Patch**: `local/patches/base/P18-3-msi-msix-enablement.patch`
**Status v2**: In `enable_function()`, MSI/MSI-X capabilities are detected and logged, then disabled to clean state. Legacy IRQ is configured for ALL devices as a baseline (including MSI-capable ones). Drivers that support MSI (e.g., virtio-netd, nvmed) enable MSI themselves via `pci_allocate_interrupt_vector()`. Drivers without MSI support (e.g., ahcid) use the legacy interrupt. Validated on q35 (AHCI MSI device) and i440fx — no panics. Pre-existing virtio-netd MSI allocation bug (irq_helpers.rs:193 .expect() on EEXIST) exposed but not caused by this change.
#### P18-4: pcid-spawner / driver-manager Unification (High U29)
**Files**: `local/recipes/system/driver-manager/`, `recipes/core/base/source/drivers/pcid-spawner/`
**Change**: Eliminate the race between pcid-spawner and driver-manager by making driver-manager the sole PCI driver spawner. Deprecate pcid-spawner. Driver-manager already has the config infrastructure.
#### P18-5: ACPID Robustness (High U17) — ✅ DONE
**Files**: `drivers/acpid/src/acpi.rs`, `drivers/acpid/src/aml_physmem.rs`
**Patch**: `local/patches/base/P18-5-acpid-robustness.patch`
**Status**: RSDP_ADDR env var now falls back to BIOS-area probe (0xE0000–0xFFFFF) scanning for "RSD PTR " signature. read_phys_or_fault returns zero instead of panic. map_physical_region maps zero-page fallback on failure. unmap_physical_region logs error instead of expect-panic. Built and boot-tested on redbear-mini.
#### P18-6: Watchdog/Health Monitoring (High U41)
**Files**: `recipes/core/base/source/init/src/main.rs`
**Change**: Optional health-check ping in scheme protocol. Init checks critical services every 5s. On failure, restart per restart policy.
#### P18-7: SIGTERM Handling in Daemons (High U39) — ✅ DONE (driver-manager)
**Files**: `local/recipes/system/driver-manager/source/src/main.rs`, `Cargo.toml`
**Reference Patch**: `local/patches/driver-manager/P18-7-sigterm-handler.patch`
**Status**: SIGTERM handler via libc::signal setting AtomicBool flag. idle_forever() polls flag every 1s (was 3600s). Deferred retry loop checks flag. graceful_shutdown() function. Added libc dependency. Built and boot-tested on redbear-mini. ACPID shutdown is already handled via kernel kstop pipe.
#### P18-8: Bounded Scheme Request Queues (Medium) — ✅ COMPLETE
**Files**: `recipes/core/base/source/ipcd/` (chan.rs, uds/stream.rs, uds/dgram.rs)
**Patch**: `local/patches/base/P18-8-bounded-ipcd-queues.patch`
**Change**: Added bounded queue depth limits to ipcd: MAX_LISTENER_BACKLOG (64) for channel listeners, MAX_UDS_LISTENER_BACKLOG (64) for UDS stream listeners, MAX_UDS_PACKET_QUEUE (256) for UDS stream packet queues, MAX_DGRAM_QUEUE (256) for UDS datagram queues. Returns ECONNREFUSED when connection backlog is full, EAGAIN when packet/datagram queue is full. Built and boot-tested on redbear-mini.
#### P18-9: MSI/MSI-X Allocation Resilience (High U27) — ✅ DONE
**Files**: `drivers/pcid/src/driver_interface/irq_helpers.rs`, `drivers/virtio-core/src/transport.rs`, `drivers/virtio-core/src/arch/x86.rs`, `drivers/net/virtio-netd/src/main.rs`, `drivers/storage/virtio-blkd/src/main.rs`, `drivers/usb/xhcid/src/main.rs`
**Patch**: `local/patches/base/P18-9-msi-allocation-resilience.patch`
**Status**: Six-file fix for pre-existing MSI vector allocation panic:
1. `allocate_aligned_interrupt_vectors()`: Handles `EEXIST` by releasing partial range and restarting search from next aligned position (renamed `first` → `first_aligned` to enable resetting).
2. `allocate_single_interrupt_vector_for_msi()`: Returns `Option<(MsiAddrAndData, File)>` instead of panicking. Logs warning on allocation failure.
3. `allocate_first_msi_interrupt_on_bsp()`: Returns `Option<File>` instead of panicking.
4. `pci_allocate_interrupt_vector()`: Proper MSI-X → MSI → legacy fallback chain. MSI-X is only enabled in config space after successful vector allocation. On failure, falls back without leaving MSI-X enabled.
5. `virtio-core/transport.rs`: Added `MsiAllocationFailed` error variant.
6. `virtio-core/arch/x86.rs`: Uses `ok_or(Error::MsiAllocationFailed)?` instead of panicking.
7. `virtio-netd/main.rs` and `virtio-blkd/main.rs`: `daemon_runner` logs error and exits cleanly instead of `.unwrap()` panic.
8. `xhcid/main.rs`: MSI-X → MSI → legacy → polling fallback chain.
**Validated**: Boots on q35/4CPU with zero panics. virtio-netd exits gracefully when no vectors available. ahcid uses legacy IRQ. Rest of system continues normally.
---
### Phase 4: Stress Test & Validation (P19) — 2/4 complete
#### P19-1: Multi-Core Driver Stress Test — ✅ PASS (2026-05-17)
**Result**: QEMU q35 machine with 4 CPUs booted to login successfully. AHCI, virtio-blk, and all core drivers started without panics.
**Script**: `local/scripts/test-smp-stress-qemu.sh`
**Findings**:
- ✅ 4 CPUs online, SMP scheduler stable
- ✅ AHCI driver started (IRQ 10 legacy fallback) — P18-3 v2 fix validated
- ✅ virtio-blk disk detected (3M sectors)
- ✅ ACPID, pcid, ipcd all stable
- ✅ virtio-netd exits gracefully instead of panicking — P18-9 fix (was: irq_helpers.rs:193 .expect() on EEXIST)
- ✅ driver-manager probe loop bounded by P18-2 max_retries=3 (reduced from 30)
- ❌ dd-based I/O stress ineffective — Redox `/dev/null` is a scheme, shell redirection fails
- **Remaining**: (1) Root cause why CPU 0 has no available MSI vectors on q35 (kernel vector count investigation), (2) Redesign stress test for Redox scheme-based I/O
#### P19-2: IRQ Vector Debug + Close Bug Fix — ✅ DONE (2026-05-17)
**Patch**: `local/patches/kernel/P19-2-irq-debug.patch`
**Changes** (kernel `scheme/irq.rs` + `arch/x86_shared/idt.rs`):
1. **Bug fix**: `Handle::Irq` now stores `cpu_id: LogicalCpuId` alongside `irq` and `ack`. Previously, `close()` always unreserved on BSP (`LogicalCpuId::BSP`) regardless of which CPU the vector was allocated on — a correctness bug causing vector leaks on APs.
2. **Debug logging**: `available_irqs_iter()` logs `cpu_id` and available vector count per call.
3. **Debug logging**: IRQ `getdents` for `Handle::Avail` logs `cpu_id`, `opaque`, and number of entries listed.
4. **Debug logging**: IRQ `close()` logs which CPU the vector is being unreserved on.
**Purpose**: Runtime diagnosis of the IRQ vector scarcity mystery on q35 (CPU 0 appearing to have zero available MSI vectors despite ~201 expected). The debug logs will reveal whether the IDT reservations are correct at runtime and whether `read_dir` is returning empty or if the issue is elsewhere.
**Note**: This is a diagnostic patch. Once the IRQ vector scarcity root cause is confirmed and fixed, the `log::info!` calls should be removed or converted to `log::debug!`.
#### P19-2b: Repo Cook Fork Safety Hardening — ✅ DONE (2026-05-17)
**Changes** (build system `src/cook/fetch.rs` + `cookbook.toml`):
1. **`cookbook.toml`**: Created with explicit `offline = true` — makes the offline-first policy explicit rather than relying on code defaults.
2. **Auto-protect patched recipes**: `recipe_has_patches()` function checks if a recipe has patches in its `recipe.toml`. `redbear_should_protect()` now protects any recipe that either (a) is on the explicit protected list, OR (b) has patches. This prevents accidental upstream re-fetching from breaking patch context lines.
3. **Warning on bypass**: When `--allow-protected` is used on a patched recipe, a `[WARN]` message is logged: "recipe X has patches but --allow-protected is set — upstream source changes may break patches".
**Audit result**: The 3-layer protection (COOKBOOK_OFFLINE=true → fetch_offline, redbear_protected_recipe → redirect to fetch_offline, REDBEAR_RELEASE → block explicit fetch) is solid. The auto-protect addition closes the gap where a recipe with patches but not on the explicit list could be re-fetched from upstream.
---
## Priority Ordering
### ✅ Completed (P16) — This Session
1. ✅ **P16-3**: MAX_CPU_COUNT 128→256
2. ✅ **P16-1**: TSC-calibrated SIPI delays + fix xAPIC ICR + add second SIPI
3. ✅ **P16-2**: ESR check + graceful degradation + CPU count log
4. ✅ **P16-4**: Firmware bug detection (duplicate APIC IDs, SDT checksums)
### Next (P17) — Desktop-Safe Scheduler
Depends on P16 completion. See individual patches above.
### Then (P18) — Userspace Hardening + Firmware
Depends on P16+P17 for stable kernel foundation. Includes firmware loading fixes.
### Finally (P19) — Stress Testing
Depends on P16+P17+P18 for full stack validation.
---
## Acceptance Criteria
- [ ] All Critical and High issues resolved
- [ ] Boot to login prompt in <10s on QEMU (4 cores)
- [ ] No panics under 72-hour stress test (4 cores, all driver types)
- [ ] AP startup race-free with 256 simulated CPUs
- [ ] NUMA topology correctly discovered from QEMU SRAT
- [ ] Service restart within 5 seconds of crash
- [ ] No priority inversion >100ms under load
- [ ] MSI/MSI-X enabled for all PCI devices that support it
- [ ] No duplicate scheme registrations possible
- [ ] All patches in `local/patches/kernel/` or `local/patches/base/`, wired into `recipe.toml`
- [ ] Boot-tested on QEMU UEFI with `scripts/run_mini.sh`
## Dependency Graph
```
P16-3 (MAX_CPU) ──────────────────────────────┐
P16-1 (SIPI timing) ──────────────────────────┤
P16-2 (ESR check + graceful degradation) ─────┤
P16-4 (firmware bugs) ────────────────────────┼──→ P17-* (scheduler)
P16-5 (TLB range race, from P15-3) ───────────┤
P16-6 (NUMA ordering, from P15-5) ────────────┘
P17-* ──→ P18-1 (restart policy)
P18-2 (crash cleanup)
P18-3 (MSI/MSI-X enablement)
P18-4 (pcid-spawner unification)
P18-5 (acpid robustness)
P18-6 (watchdog)
P18-7 (SIGTERM)
P18-8 (bounded queues)
P18-* ──→ P19-* (stress tests)
```
---
## Firmware Loading Assessment (Added 2026-05-16)
### Architecture
The firmware loading system is well-designed with three-tier caching:
1. **In-memory cache** (`HashMap<String, CachedBlob>`)
2. **Persistent cache** (`/var/lib/firmware/cache`) — survives daemon restarts
3. **Filesystem** (`/lib/firmware`) — primary source
**Fallback chains**: TOML-configured in `/etc/firmware-fallbacks.d/`, with built-in fallbacks for AMD DCN and Intel Wi-Fi.
**Linux KPI compatibility**: `request_firmware()` / `release_firmware()` via `linux-kpi/source/src/rust_impl/firmware.rs`.
### Firmware Issues
| # | Severity | Issue | File | Detail |
|---|----------|-------|------|--------|
| FW1 | Critical | No real AMD GPU firmware files | `local/firmware/` (empty) | DCN 3.5+, GC 11.x, PSP, SDMA, VCN firmware missing |
| FW2 | Critical | No real Intel Wi-Fi firmware files | `local/firmware/` (empty) | AX200/AX201/AX210/AX211 .ucode files missing |
| FW3 | Critical | Driver vs firmware-loader race | `driver-manager/config.rs:236` | Only checks scheme path, not specific files |
| FW4 | Critical | No firmware-ready notifications | `firmware-loader/async.rs` | Uevents dispatched but no consumers |
| FW5 | Critical | No firmware dependency in driver config | `driver-manager/config.rs:532` | Drivers can't declare required firmware files |
| FW6 | High | No boot-critical firmware pre-population | initfs | Display firmware not embedded for early boot |
| FW7 | High | Deferred probe timeout too short | `driver-manager/main.rs:407` | 15s total (500ms × 30 retries) insufficient for large GPU firmware |
| FW8 | High | No firmware loader crash recovery | init | If firmware-loader crashes, /scheme/firmware gone permanently |
| FW9 | High | No firmware version pinning | `manifest.rs` | SHA256 hashes generated but never validated on load |
| FW10 | Medium | Cache poisoning on concurrent access | `blob.rs:645` | Mutex poisoned on panic, subsequent cache accesses fail silently |
| FW11 | Medium | No per-operation firmware load timeout | `scheme.rs:16` | Single 5s timeout for all firmware regardless of size |
| FW12 | Medium | No firmware inventory tool | `main.rs` | No `/proc/firmware` equivalent for debugging |
| FW13 | Medium | No firmware size limits | `linux-kpi/firmware.rs:65` | Arbitrary-size allocation, potential DoS |
| FW14 | Low | No firmware signature verification | all | SHA256 hashes not validated on load |
### Firmware Loading Patches (P18-FW Series)
#### P18-FW1: Firmware Availability Handshake (Critical FW3, FW5)
**Files**: `local/recipes/system/firmware-loader/source/src/scheme.rs`, `local/recipes/system/driver-manager/source/src/config.rs`
**Change**:
1. firmware-loader publishes indexed firmware list at `/scheme/firmware/.index`
2. driver-manager checks specific firmware files before probing driver
3. Add `firmware_requires = [...]` to driver config TOML schema
#### P18-FW2: Firmware Loader Watchdog + Restart (High FW8)
**Files**: `recipes/core/base/source/init/src/service.rs`
**Change**: Add `restart = "always"` to firmware-loader service. Init respawns on crash.
#### P18-FW3: Extended Deferred Probe Timeout (High FW7)
**Files**: `local/recipes/system/driver-manager/source/src/main.rs`
**Change**: Increase max_retries to 60 (30s total), add per-driver `probe_timeout` config.
#### P18-FW4: Firmware Pre-Population for Boot-Critical Devices (High FW6)
**Files**: `config/redbear-full.toml`
**Change**: Add AMD DMCU and Intel Wi-Fi firmware blobs to image via `[[files]]` or dedicated firmware package.
---
## Implementation Status
### Completed This Session (2026-05-16)
- ✅ **P16-1**: TSC-calibrated SIPI delays + fix xAPIC ICR (0x4600→0x0600) + add second SIPI
- ✅ **P16-2**: ESR check before/after SIPI + CPU count log + approaching-limit warning
- ✅ **P16-3**: MAX_CPU_COUNT 128→256
- ✅ **P16-4**: Firmware bug detection (duplicate APIC IDs, SDT checksum validation)
- ✅ **P16-1/2/3/4 patches**: Generated, validated (25/25 pass), wired into recipe.toml
- ✅ **Build + boot test**: Kernel cooks, full image builds, QEMU boots with zero panics
- ✅ **Firmware loading assessment**: 14 issues identified, 4 P18-FW patches planned
### Boot Test Evidence
```
MADT: duplicate APIC ID 0 in LocalApic entry, firmware bug ← P16-4 working
SMP: 1 CPUs online (max 256) ← P16-3 working
```
local/docs/COMPREHENSIVE-SYSTEM-ASSESSMENT-AND-IMPROVEMENT-PLAN.md
+933
View File
@@ -0,0 +1,933 @@
# Red Bear OS — Comprehensive System Assessment & Improvement Plan
**Version**: 1.0 (2026-05-20)
**Reference**: Linux kernel 7.1 (`local/reference/linux-7.1/`)
**Supersedes**: `IMPLEMENTATION-MASTER-PLAN.md`, `SUBSYSTEM-ASSESSMENT-2026-05.md`,
`SMP-BOOT-HARDENING-PLAN.md`, `CPU-DMA-IRQ-MSI-SCHEDULER-FIX-PLAN.md`,
`COMPREHENSIVE-BOOT-IMPROVEMENT-PLAN.md`
**Canonical adjacent plans** (remain authoritative for subsystem detail):
- `ACPI-IMPROVEMENT-PLAN.md` — ACPI waves W0–W7
- `IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md` — PCI/IRQ/MSI-X
- `USB-IMPLEMENTATION-PLAN.md` — USB phases U0–U6
- `CONSOLE-TO-KDE-DESKTOP-PLAN.md` — desktop path
- `DRM-MODERNIZATION-EXECUTION-PLAN.md` — GPU stack
---
## 1. Executive Summary
Red Bear OS is **architecturally sound** but has **significant gaps in hardware-facing
subsystems**. The system boots to a login prompt in QEMU with working console,
networking, and basic device enumeration. However, the boot log and codebase audit
reveal that **bare-metal usability is limited**: the system runs hot (no C-states,
no thermal backend), may not see all CPU cores (AP startup races), may lose USB
keyboard (only xHCI exists), and has minimal observability for operators.
This document is a **truthful, evidence-based assessment** of every low-level
subsystem, grounded in source code inspection, boot log analysis, and comparison
against Linux 7.1 reference source. It replaces five stale/duplicate planning
documents with one canonical assessment and forward plan.
### Bottom-line verdicts
| Subsystem | Verdict |
|-----------|---------|
| **SMP** | Real in kernel, but AP startup races and no bare-metal validation |
| **CPU power (C-states)** | **Completely missing** — root cause of heat on bare metal |
| **CPU power (P-states)** | Partial — cpufreqd exists but fragile |
| **Thermal / sensors** | Daemon exists but **no backend** — runs with empty surface |
| **ACPI boot** | Boot-baseline complete, not release-grade |
| **ACPI thermal/fan** | **Missing** — not implemented in acpid |
| **USB xHCI** | Real, QEMU-validated only |
| **USB EHCI/UHCI/OHCI** | **No drivers exist** — bare-metal USB keyboard unreliable |
| **PCI / IRQ / MSI-X** | Architecturally strong, low adoption in drivers |
| **IOMMU AMD-Vi** | Real, QEMU first-use proof only |
| **IOMMU Intel VT-d** | **Missing** — orphaned DMAR parsing only |
| **Firmware loading** | Real, on-demand, async |
| **Memory management** | Basic frame allocator — no swap/NUMA/hotplug |
| **Logging** | Append-only `/var/log/system.log` — no rotation/structured storage |
| **Udev** | Real but limited — polling hotplug, hardcoded rules |
---
## 2. Assessment by Subsystem
### 2.1 SMP / CPU Bring-up
**Status**: 🟡 Implemented, QEMU-proven, **bare-metal unvalidated**
**Linux 7.1 equivalent**: `arch/x86/kernel/smpboot.c`, `arch/x86/kernel/apic/`,
`kernel/smp.c`
#### What is real
The kernel has a **complete AP bring-up path**:
- AP trampoline with INIT/SIPI sequencing (`madt/arch/x86.rs`)
- x2APIC/LocalApic branching with zero-extended ID fallback
(`local_apic.rs`)
- `multi_core` feature enabled by default (`Cargo.toml`)
- Per-CPU data structures (`percpu.rs`)
- IPI support for TLB shootdowns and scheduler wakeups
- CPU set tracking (`cpu_set.rs`)
Source files inspected:
- `recipes/core/kernel/source/src/acpi/madt/arch/x86.rs`
- `recipes/core/kernel/source/src/arch/x86_shared/device/local_apic.rs`
- `recipes/core/kernel/source/src/startup/mod.rs`
- `recipes/core/kernel/source/src/cpu_set.rs`
#### Why you see "SMP: 1 CPUs online"
The boot log shows:
```
kernel::acpi::madt::arch:INFO -- SMP: 1 CPUs online (max 256)
```
This can happen for three reasons:
1. **QEMU i440fx exposes only 1 vCPU to the guest** (most likely in this boot)
2. **AP startup timeout** — `AP_SPIN_LIMIT=1_000_000` spin counts vary by clock
speed; on slow or heavily loaded bare metal, APs may not signal readiness in
time
3. **Firmware MADT only exposes 1 processor entry** — rare but possible on
broken firmware
On real bare metal with an AMD Ryzen or Intel Core system, if the firmware
exposes multiple LocalApic entries and AP startup succeeds, the kernel **will**
bring up all cores. But this has **never been validated** on the project's
hardware matrix.
#### Critical weaknesses (38 kernel issues found)
`SMP-BOOT-HARDENING-PLAN.md` (2026-05-16) documented **54 issues** across kernel
and userspace boot. The most critical kernel-side items are:
| Issue | Severity | File | Description |
|-------|----------|------|-------------|
| AP startup LogicalCpuId race | **Critical** | `madt/arch/x86.rs:153,244,276,365` | Two APs load `CPU_COUNT` simultaneously → same ID |
| AP_READY dual-mechanism race | **Critical** | `madt/arch/x86.rs:174-225` | Trampoline u64 write + static `AtomicBool` — inconsistent ordering |
| TLB shootdown range race | **Critical** | `percpu.rs:134-137` | Concurrent shootdowns overwrite range between flag set and IPI |
| MCS lock missing fences | **Critical** | `sync/mcs.rs:74-101` | No Release/Acquire on MCS lock handoff |
| Unbounded priority inversion | **Critical** | `sync/mcs.rs:126-145` | PI donation one level only |
| Scheduler panic flag leak | **Critical** | `switch.rs:164,298` | `in_context_switch` stays true on panic → CPU lockup |
| Missing SIPI delays | **High** | `madt/arch/x86.rs:192-337` | Spin-count delays, not TSC-based. Intel SDM requires 10ms INIT→SIPI |
| NUMA node set after CPU visible | **High** | `madt/arch/x86.rs:244,253` | `CPU_COUNT.fetch_add()` before `numa_node.set()` |
| MAX_CPU_COUNT=128 too small | **High** | `cpu_set.rs:44` | AMD EPYC has 128C/256T, Threadripper PRO 96C/192T |
| Global IRQ count lock | **High** | `scheme/irq.rs:67` | `COUNTS.lock()` is global spinlock on hot path |
These are **not theoretical**. The LogicalCpuId race means two APs can claim
the same CPU ID, leading to corrupted per-CPU data. The missing SIPI delays
mean APs may fail to start on real hardware with strict firmware timing
requirements.
#### Gaps vs Linux 7.1
| Feature | Linux 7.1 | Red Bear |
|---------|-----------|----------|
| Robust AP bring-up | `smpboot.c` with TSC delays, online checks | Spin-count delays, race conditions |
| CPU hotplug | Full hot-add/hot-remove | Not implemented |
| CPU isolation | `isolcpus`, `nohz_full` | Not implemented |
| NUMA | Node-aware scheduling, memory policies | No NUMA awareness |
| Per-CPU idle threads | `cpuhp/`, idle thread per CPU | APs enter idle loop directly |
| x2APIC fallback | Clean fallback with explicit disable | Fallback works but warns |
**Verdict**: SMP infrastructure is real but has **critical races** that must be
fixed before bare-metal multi-core can be trusted. No hardware validation exists.
---
### 2.2 CPU Power Management (P-states / C-states)
**Status**: 🟡 P-states partial, **C-states missing entirely**
**Linux 7.1 equivalent**: `drivers/cpufreq/`, `drivers/cpuidle/`,
`drivers/acpi/processor.c`, `arch/x86/kernel/acpi/cstate.c`
#### P-states (frequency scaling)
`cpufreqd` is a **real userspace daemon** that:
- Reads ACPI `_PSS` (Performance States) tables
- Samples CPU load periodically
- Writes `IA32_PERF_CTL` MSR to change P-state
- Supports governors: Ondemand, Performance, Powersave
- Exposes `/scheme/cpufreq`
Source: `local/recipes/system/cpufreqd/source/src/main.rs`
**But it is fragile**:
1. `write_msr()` ignores its `msr` parameter and writes only the value to
`/dev/cpu/<n>/msr`. This suggests it depends on a Linux-style MSR driver that
uses file offset as the MSR index. No such driver was found in the Red Bear
tree.
2. The daemon reads MSR temperature via `IA32_THERM_STATUS` but has no
actionable thermal policy — it can request "powersave" from cpufreqd itself,
but there is no thermal trip point logic.
3. On the boot log: `cpufreqd: CPU0: 4 P-states (2400 - 1200 kHz)` followed by
`cpufreqd: CPU0: MSR write failed (1/1)` — **the P-state change is failing**.
#### C-states (idle power states)
**This is completely missing** and is the **single largest contributor to system
heat on bare metal**.
What exists:
- The kernel has a normal `hlt` instruction in the idle loop when no threads are
runnable
- No dedicated cpuidle subsystem
- No ACPI `_CST` (C-state) table parsing
- No `mwait` / `monitor` usage for deeper C-states
- No C1E, C3, C6, C7 support
What Linux 7.1 has:
- `drivers/cpuidle/` with multiple drivers: `acpi_idle`, `intel_idle`, `amd_idle`
- `_CST` table parsing in ACPI processor driver
- `mwait` hint selection based on C-state depth
- Latency and power measurements per C-state
- Scheduler integration: `cpuidle_enter()` called from idle loop
**Verdict**: cpufreqd is real but MSR writes are failing. C-states are
**completely absent**. On bare metal, CPUs run at full power even when idle.
This is why the system is "very hot."
---
### 2.3 Thermal Management / Sensors / Hardware Monitoring
**Status**: 🔴 Thermal daemon exists but **no backend**; sensors missing; hwmon
absent
**Linux 7.1 equivalent**: `drivers/thermal/`, `drivers/hwmon/`,
`drivers/acpi/thermal.c`, `drivers/acpi/fan.c`
#### thermald
`thermald` is **real code**, not a stub. It:
- Attempts to read ACPI thermal zones
- Reads CPU MSR temperature (`IA32_THERM_STATUS`)
- Can request powersave from cpufreqd
- Can request ACPI sleep
- Exposes `/scheme/thermal`
Source: `local/recipes/system/thermald/source/src/main.rs`
**But it runs with an empty surface**:
- ACPI thermal zone enumeration is **missing from acpid**. The ACPI daemon's
scheme surface (`/scheme/acpi`) has no thermal or fan nodes.
- `thermald` expects `/scheme/acpi/thermal` and `/scheme/acpi/fan` to exist, but
they do not.
- `fan.rs` exists in the thermald source tree but is **orphaned** — it is not
wired into `main.rs` (`mod fan;` is absent).
The boot log shows:
```
[ OK ] Started Thermal management daemon
2026-05-20T09-13-44.583Z [@thermald:19 INFO] thermald: started
```
And then nothing. No thermal zones found, no temperature readings, no fan
control.
#### Hardware sensors (hwmon)
**There is no hwmon infrastructure** in Red Bear OS.
What is missing:
- No `/sys/class/hwmon` equivalent
- No `/scheme/hwmon`
- No sensor drivers
Linux 7.1 has **100+ hwmon drivers** covering:
- CPU temperature: `coretemp` (Intel), `k10temp` (AMD)
- Motherboard sensors: `nct6775`, `it87`, `f71882fg`
- Voltage regulators: `ina2xx`, `ltc2947`
- Fan speed monitors: various Super-I/O chips
Red Bear has **none of these**.
#### SMBIOS / DMI
SMBIOS parsing exists in `acpid/src/dmi.rs`, but the boot log shows:
```
2026-05-20T09-12-40.920Z [@acpid::dmi:124 WARN] SMBIOS entry point not found in 0xF0000-0xFFFFF
```
This means DMI-based quirks and system identification are **best-effort only**.
On systems without a valid SMBIOS entry point, the quirk system falls back to
PCI/USB device ID matching only.
**Verdict**: thermald is real but powerless. No hwmon, no sensor drivers, no
ACPI thermal backend. The system has **zero thermal awareness**.
---
### 2.4 ACPI Stack
**Status**: 🟡 Boot-baseline complete, **not release-grade**
**Linux 7.1 equivalent**: `drivers/acpi/`, `include/acpi/`
#### What is strong
- Kernel early ACPI discovery: RSDP, RSDT, XSDT
- MADT parsing: LocalApic, IoApic, IntSrcOverride, NMI
- x2APIC fallback with zero-extended IDs
- FADT parsing, PM1a/PM1b register access
- AML interpreter v6.1.1 with real mutex tracking
- EC (Embedded Controller) byte-transaction access
- `_S5` shutdown derivation (though timing is fragile)
- `kstop` kernel shutdown eventing consumed by `redbear-sessiond`
- DMI exposure via `/scheme/acpi/dmi`
Source files:
- `recipes/core/kernel/source/src/acpi/`
- `recipes/core/base/source/drivers/acpid/src/`
#### What is weak
| Area | Status | Detail |
|------|--------|--------|
| acpid startup | Fragile | Active panic-grade `expect()` paths on firmware-origin data |
| `_S5` timing | Fragile | Derived after PCI registration; pre-PCI shutdown reports "AML not ready" |
| DMAR | Orphaned | Parsing exists in `acpid/src/dmar/mod.rs` but not wired; Intel VT-d has no owner |
| Sleep beyond S5 | Missing | `set_global_s_state()` is S5-only; S3 suspend not validated |
| Thermal zones | Missing | No ACPI thermal zone enumeration |
| Fan devices | Missing | No ACPI fan device support |
| Battery/power | Provisional | `power_snapshot()` does real AML-backed probing but bootstrap preconditions are weak |
| AML fault handling | Partial | `aml_physmem.rs` has "log then fabricate 0" paths |
| SMBIOS | Best-effort | Entry point missing on many systems |
The ACPI improvement plan (`ACPI-IMPROVEMENT-PLAN.md`) tracks 8 waves of work
(W0–W7). Current status:
- W0 (Contracts): partially complete
- W1 (Startup hardening): partially complete
- W2 (AML ordering/shutdown): partially complete
- W3 (Honest power surface): **open**
- W4 (Physmem/EC/fault): partially complete
- W5 (Ownership cleanup): **open**
- W6 (Consumer integration): partially complete
- W7 (Validation closure): **open**
**Verdict**: ACPI is the most mature low-level subsystem, but it is still
**boot-baseline complete**, not release-grade. Thermal and fan support are
completely absent.
---
### 2.5 PCI / IRQ / MSI-X
**Status**: 🟡 Architecturally strong, **adoption-incomplete**
**Linux 7.1 equivalent**: `drivers/pci/`, `arch/x86/kernel/apic/`,
`drivers/iommu/`
#### What is real
- `pcid` enumerates PCI devices via config space (I/O ports 0xCF8/0xCFC fallback
when no ECAM/MCFG)
- Capability parsing: MSI, MSI-X, power management, vendor-specific
- `driver-manager` matches TOML configs by bus/class/vendor and spawns drivers
- Kernel MSI message composition and validation (`msi.rs`, `vector.rs`)
- MSI-X table mapping and vector allocation
- `redox-driver-sys` provides IRQ handle abstractions, affinity helpers
- IOAPIC routing with interrupt source overrides
- Legacy PIC fallback
Source files:
- `recipes/core/base/source/drivers/pcid/`
- `local/recipes/system/driver-manager/`
- `recipes/core/kernel/source/src/arch/x86_shared/device/msi.rs`
- `local/recipes/drivers/redox-driver-sys/source/src/irq.rs`
#### What is weak
| Issue | Detail |
|-------|--------|
| Legacy IRQ dominance | `e1000d` and `ided` still use legacy IRQ (IRQ 11, IRQ 14/15) |
| MSI-X adoption | Only `ixgbed` and GPU paths use MSI-X; most drivers on legacy INTx |
| IOMMU MSI gate | `iommu_validate_msi_irq()` is a stub — always returns `true` |
| IRQ affinity | Available in API but not widely used |
| pcid helper fragility | Some paths still treat malformed capabilities as invariants |
| Hardware validation | MSI-X proven in QEMU only; no real hardware vector validation |
The IRQ/low-level plan (`IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md`)
correctly identifies that the architecture is sound but the **runtime proof is
thin**. Priority 1 is "MSI-X runtime validation on real devices."
**Verdict**: The PCI/IRQ substrate is one of the strongest parts of the stack,
but it is **not yet release-grade** because MSI-X is not widely adopted and
hardware validation is missing.
---
### 2.6 IOMMU / DMA
**Status**: 🟡 AMD-Vi real but **unvalidated**; Intel VT-d **missing**
**Linux 7.1 equivalent**: `drivers/iommu/amd/`, `drivers/iommu/intel/`,
`drivers/iommu/dma-iommu.c`
#### AMD-Vi
The `iommu` daemon is **real**, not a stub:
- `AmdViUnit::init()` maps MMIO, programs device tables, command buffer, event
log, interrupt remap table (IRTE)
- QEMU first-use proof passes: discovers units, initializes, drains events
- Self-test path exists: `redbear-phase-iommu-check`
Source: `local/recipes/system/iommu/source/src/amd_vi.rs`
**But**:
- The boot log shows: `iommu: no AMD-Vi units found (source=none,
kernel_acpi_status=empty, ivrs_path=none)`
- This happens because the IVRS table is absent on this platform (QEMU i440fx
does not provide IVRS)
- When zero units are found, the daemon registers `scheme:iommu` and exits
- **Real AMD hardware validation: NONE**
#### Intel VT-d
- DMAR parsing exists in `acpid/src/dmar/mod.rs` but is **orphaned**
- No Intel VT-d runtime daemon
- No DMA remapping for Intel platforms
- `iommu` daemon is AMD-Vi only
#### DMA integration
- DMA allocation exists in `redox-driver-sys`
- But IOMMU integration is incomplete: `iommu_validate_msi_irq()` is a no-op,
and there is no enforced DMA map/unmap with IOMMU translation
- Linux 7.1 has `dma-iommu.c` which handles IOMMU-aware DMA mapping for all
devices behind an IOMMU
**Verdict**: AMD-Vi is implemented but unvalidated. Intel VT-d is missing.
DMA/IOMMU integration is incomplete.
---
### 2.7 USB Stack
**Status**: 🟡 xHCI real but **QEMU-only**; **EHCI/UHCI/OHCI missing**
**Linux 7.1 equivalent**: `drivers/usb/host/`, `drivers/usb/core/`,
`drivers/hid/usbhid/`
#### xHCI
The xHCI driver (`xhcid`) is **real and substantial**:
- ~6,000 lines of Rust
- 88+ error handling fixes applied via Red Bear patch
- Interrupt-driven path restored (MSI/MSI-X/INTx)
- Event ring growth implemented (ring doubling)
- BOS/SuperSpeed descriptor fetching
- Speed detection for hub children
- USB 3 hub endpoint configuration
- Suspend/resume API skeleton
Source: `recipes/core/base/source/drivers/usb/xhcid/`
**But**:
- Only **QEMU-validated** — no real hardware testing
- ~57 TODO/FIXME comments remain
- Some `panic!()` sites remain in device enumerator
#### Missing host controllers
**No EHCI, UHCI, or OHCI drivers exist** in the Red Bear tree.
| Controller | Speed | Why it matters |
|------------|-------|----------------|
| EHCI | USB 2.0 High Speed | Most USB 2.0 keyboards/mice |
| OHCI | USB 1.1 Full/Low Speed | AMD/VIA legacy USB |
| UHCI | USB 1.1 Full/Low Speed | Intel legacy USB |
Linux 7.1 has full implementations for all three:
- `drivers/usb/host/ehci-hcd.c` (~4,500 lines)
- `drivers/usb/host/ohci-hcd.c` (~3,500 lines)
- `drivers/usb/host/uhci-hcd.c` (~2,800 lines)
The USB implementation plan honestly states:
> "External USB keyboard input is reliably available only when the keyboard is
> reached through the `xHCI -> usbhubd/usbhidd -> inputd` path."
On many bare-metal systems, USB keyboards route through EHCI or OHCI, not xHCI.
**Red Bear cannot claim reliable USB keyboard boot fallback.**
#### Class drivers
| Driver | Status | Quality |
|--------|--------|---------|
| `usbhubd` | Real | Good — interrupt-driven change detection, graceful per-port errors |
| `usbhidd` | Real | Good — HID report parsing, named producers, no panics in loop |
| `usbscsid` | Real | Good — BOT transport, stall recovery, `ReadCapacity16` |
**Verdict**: xHCI is real but QEMU-only. The absence of EHCI/UHCI/OHCI is a
**critical bare-metal gap**.
---
### 2.8 Firmware Loading
**Status**: 🟢 **Real and functional**
**Linux 7.1 equivalent**: `drivers/base/firmware_loader/`
The `firmware-loader` daemon is one of the most complete subsystems:
- On-demand blob loading via `scheme:firmware`
- Indexes `/lib/firmware` at startup
- Persistent cache with fallback chains
- Async `request_firmware_nowait()` with timeout and retry
- Emits uevents for consumers
- Read-only scheme with mmap support
Source: `local/recipes/system/firmware-loader/source/`
The boot log does not show firmware loading activity because no device requested
firmware during this boot (no GPU, no Wi-Fi).
**Verdict**: This subsystem is **production-ready** architecturally. Needs
hardware validation when GPU/Wi-Fi drivers are active.
---
### 2.9 Memory Management
**Status**: 🟡 Basic but functional; **advanced features missing**
**Linux 7.1 equivalent**: `mm/`, `arch/x86/mm/`
#### What is real
- Frame allocator / buddy-like free list
- Kernel page-table setup (4-level on x86_64)
- Device-memory mapping for MMIO
- Explicit memory-region handling
- Early boot memory map parsing from ACPI/firmware
- 7,092 MB detected in boot log
Source:
- `recipes/core/kernel/source/src/memory/mod.rs`
- `recipes/core/kernel/source/src/startup/memory.rs`
#### What is missing
| Feature | Linux 7.1 | Red Bear |
|---------|-----------|----------|
| Swap | Full swap with page reclaim | Not implemented |
| NUMA | Node-aware allocation, migrate pages | No NUMA awareness |
| Memory hotplug | Add/remove memory at runtime | Not implemented |
| Reclaim/compaction | `kswapd`, memory pressure handling | Not implemented |
| OOM killer | `out_of_memory()` kills processes | Not implemented |
| Huge pages | THP, hugetlbfs | Not implemented |
| Memory cgroups | `memcg` resource limits | Not implemented |
| Demand paging | Lazy allocation on fault | Basic but no swap backing |
**Verdict**: Sufficient for current boot and userspace needs, but not
production-grade for memory-intensive workloads.
---
### 2.10 Logging Infrastructure
**Status**: 🟡 Basic append-only; **no rotation, no structured storage**
**Linux 7.1 equivalent**: No direct equivalent; compare to `systemd-journald`,
`rsyslog`, `syslog-ng`
#### What is real
- `logd` daemon serves `scheme:log`
- Persists to `/var/log/system.log`
- prepends startup banner, backfills new sinks
- Mirrors kernel log input
- relibc syslog API (`syslog()`, `openlog()`) writes to `/scheme/log`
Source:
- `recipes/core/base/source/logd/src/main.rs`
- `recipes/core/base/source/logd/src/scheme.rs`
#### What is weak
| Issue | Detail |
|-------|--------|
| Append-only | `/var/log/system.log` grows forever |
| No rotation | No size-based or time-based truncation |
| No retention | Old logs never deleted |
| No structured format | Plain text only; no JSON or binary journal |
| read path TODO | `scheme.rs` has a TODO for reading log history |
| Console dominance | Most daemon output still goes to console timestamps |
| No per-service logs | All logs in one file |
The boot log shows console timestamps because daemons write to stderr, which
init captures and logs. The persistent `/var/log/system.log` exists but is
append-only with no management.
**Verdict**: Functional for debugging but not suitable for production
observability. Needs rotation, structured format, and per-service separation.
---
### 2.11 Udev / Device Discovery
**Status**: 🟡 Real but **limited**
**Linux 7.1 equivalent**: `drivers/base/core.c`, `lib/kobject_uevent.c`, `udev/`
#### What is real
`udev-shim` is a **real implementation**, not a placeholder:
- Enumerates PCI devices via `pcid` scheme
- Classifies devices by class/subclass/vendor
- Creates `/dev` nodes and symlinks
- Writes `/etc/udev/rules.d/50-default.rules`
- Exposes `scheme:udev`
- Polls for changes (not event-driven)
Source: `local/recipes/system/udev-shim/source/`
The boot log shows:
```
[ OK ] Started udev compatibility shim
[INFO] udev-shim: enumerated 1 PCI device(s)
[INFO] udev-shim: wrote default rules to /etc/udev/rules.d/50-default.rules
```
#### What is weak
| Issue | Detail |
|-------|--------|
| Hardcoded rules | Only 3 rules: net naming (`enp*`), NVMe by-id, SATA by-id |
| Polling hotplug | Polls every N seconds; not event-driven like Linux udev/netlink |
| No rules engine | Cannot parse Linux udev rules; rules are compiled-in |
| libudev-stub TODO | `local/recipes/libs/libudev-stub/recipe.toml` explicitly marked TODO |
| Limited coverage | Only PCI devices; no USB, no ACPI, no platform devices |
| No persistent db | Device state not saved across reboots |
Linux 7.1 udev:
- Event-driven via netlink `NETLINK_KOBJECT_UEVENT`
- Full rules engine with `MATCH`, `ACTION`, `ENV`, `RUN`
- Persistent database in `/run/udev/`
- `udevadm` tool for querying and triggering
- Integrates with `systemd` for device units
**Verdict**: Functional for basic PCI device naming but far from a full udev
replacement. Polling hotplug is inefficient.
---
### 2.12 Input Stack
**Status**: 🟡 Real but **uneven quality**
**Linux 7.1 equivalent**: `drivers/input/`, `drivers/hid/`, `drivers/serio/`
#### What is real
| Component | Status | Detail |
|-----------|--------|--------|
| `ps2d` | Real | PS/2 keyboard + mouse; kernel serio byte queues |
| `usbhidd` | Real | HID report parsing, named producers |
| `inputd` | Real | Producer/consumer scheme, VT switching, keymaps |
| `evdevd` | Real | evdev scheme, orbclient→evdev translation |
| `i2c-hidd` | Real | ACPI PNP0C50 scan, _CRS parsing |
| `intel-thc-hidd` | Partial | PCI init works; main loop sleeps 5s — **no input streaming** |
The boot log shows PS/2 and evdev working:
```
[ OK ] Started PS/2 driver
[ OK ] Started Evdev input daemon
[INFO] evdevd: registered scheme:evdev
```
#### Gaps vs Linux 7.1
| Gap | Severity | Linux Reference |
|-----|----------|-----------------|
| intel-thc-hidd no streaming | **High** | `drivers/hid/intel-thc-hid/` full probe+report |
| No multitouch/ABS_MT | **High** | `drivers/input/input-mt.c` |
| No libinput acceleration | **High** | libinput: velocity curves, palm detection |
| No PS/2 extended protocols | Medium | `libps2.c` ImPS/2 scroll, Explorer 5-btn |
| No HID quirks table | Medium | `hid-quirks.c` 4000+ entries |
| No input hotplug | Medium | udev + inotify on `/dev/input/` |
**Verdict**: The input stack exists and works for basic keyboard/mouse. Touch
and advanced HID are incomplete.
---
## 3. Root Cause Analysis
### Why the system runs hot on bare metal
1. **No C-state management** → CPUs never enter low-power idle states (C1, C1E,
C3, C6, C7). They spin in the kernel idle loop at full power.
2. **No ACPI thermal zones** → `acpid` does not enumerate thermal zones, so
`thermald` has no temperature data to act on.
3. **No hwmon sensor drivers** → No temperature sensors are readable. The system
is "flying blind."
4. **No ACPI fan control** → Fan devices are not enumerated, so `thermald`
cannot turn on cooling.
5. **cpufreqd MSR writes failing** → Even P-state throttling is not working
reliably (`MSR write failed` in boot log).
**Fix priority**: C-states (immediate heat reduction) > ACPI thermal zones
(enables thermald) > hwmon sensors (operator visibility) > fan control
(active cooling).
### Why only 1 CPU shows online
1. **QEMU i440fx** exposes only 1 vCPU by default (most likely in the provided
boot log)
2. **AP startup races** — LogicalCpuId race, missing SIPI delays, AP_READY dual
mechanism can cause APs to fail startup on real hardware
3. **MAX_CPU_COUNT=128** too small for high-core-count AMD EPYC
4. No bare-metal validation means we don't know which of these is the real
blocker on actual hardware
### Why USB keyboard may not work on bare metal
1. **Only xHCI exists** — no EHCI/UHCI/OHCI drivers
2. Many systems route USB 2.0 keyboards through EHCI
3. Some AMD/VIA systems use OHCI for legacy ports
4. Some Intel systems use UHCI for legacy ports
5. No companion controller support to route low-speed devices from EHCI to xHCI
---
## 4. Honest Status Matrix
| Subsystem | Status | Linux 7.1 Parity | Evidence Class |
|-----------|--------|------------------|----------------|
| SMP bring-up | 🟡 Partial | ~30% | Source + QEMU; bare metal unvalidated |
| C-states (cpuidle) | 🔴 Missing | 0% | No subsystem exists |
| P-states (cpufreq) | 🟡 Partial | ~20% | Daemon real but MSR writes failing |
| Thermal management | 🔴 Missing backend | ~10% | thermald exists but no ACPI backend |
| Hardware sensors (hwmon) | 🔴 Missing | 0% | No infrastructure, no drivers |
| ACPI boot / shutdown | 🟢 Baseline | ~40% | Boots, shutdown works, sleep partial |
| ACPI thermal / fan | 🔴 Missing | 0% | Not implemented in acpid |
| PCI enumeration | 🟢 Working | ~60% | Real, robust, driver-manager binds |
| MSI/MSI-X infrastructure | 🟡 Real | ~40% | Kernel real, driver adoption low |
| IOMMU AMD-Vi | 🟡 Real, unvalidated | ~30% | QEMU proof only |
| IOMMU Intel VT-d | 🔴 Missing | 0% | Orphaned DMAR parsing only |
| USB xHCI | 🟡 Real, QEMU-only | ~30% | No hardware validation |
| USB EHCI/UHCI/OHCI | 🔴 Missing | 0% | No drivers |
| Firmware loading | 🟢 Real | ~70% | On-demand, async, validated in build |
| Memory management | 🟡 Basic | ~30% | Frame allocator; no swap/NUMA/hotplug |
| Logging | 🟡 Basic | ~20% | Append-only, no rotation |
| Udev | 🟡 Limited | ~25% | Polling, hardcoded rules |
| Input (PS/2, USB HID) | 🟢 Working | ~50% | Real but touch/advanced HID missing |
| Input (I2C HID, THC) | 🟡 Partial | ~20% | i2c-hidd real; intel-thc-hidd non-functional |
| D-Bus system bus | 🟢 Working | ~60% | Real, services wired |
| D-Bus session bus | 🟡 Partial | ~30% | Partially wired |
| Network (wired) | 🟢 Working | ~60% | e1000d, virtio-net work |
| Network (Wi-Fi) | 🟡 Host-tested | ~20% | Intel stack builds; no hardware validation |
| Bluetooth | 🟡 Experimental | ~15% | BLE controller probe works; limited |
---
## 5. New Improvement Plan
This plan is ordered by **impact on bare-metal usability** and **dependency
chain**. Earlier phases unblock later ones.
### Phase 1: Bare-Metal Boot Hardening (6–8 weeks)
**Goal**: Boot reliably on diverse bare metal with all cores, reasonable
temperature, and working USB keyboard.
#### 1.1 Fix SMP AP Startup (2 weeks)
- [ ] Fix K1 (LogicalCpuId race) — use `fetch_add` before AP reads ID
- [ ] Fix K2 (AP_READY dual mechanism) — consolidate to single atomic
- [ ] Fix K7 (missing SIPI delays) — add TSC-based 10ms INIT→SIPI delay per Intel SDM
- [ ] Increase MAX_CPU_COUNT to 256
- [ ] Validate on AMD Ryzen and Intel Core bare metal
- [ ] Capture boot log showing `SMP: N CPUs online` where N > 1
#### 1.2 Implement Basic C-states (2 weeks)
- [ ] Add `cpuidle` framework in kernel: idle state table, enter/exit hooks
- [ ] Parse ACPI `_CST` table in acpid, expose via `/scheme/acpi/cstates`
- [ ] Implement `hlt`-based idle (C1) — immediate heat reduction
- [ ] Add `mwait`-based C1E/C3 for Intel; add `AMD C1E` support
- [ ] Wire to scheduler idle path: call `cpuidle_enter()` when no runnable threads
- [ ] Validate temperature drop on bare metal
#### 1.3 Enable ACPI Thermal Zones (2 weeks)
- [ ] Add thermal zone enumeration to acpid (`_TZ` namespace walk)
- [ ] Expose `/scheme/acpi/thermal` with zone temperatures and trip points
- [ ] Wire thermald to read from `/scheme/acpi/thermal`
- [ ] Add passive cooling policy: throttle cpufreqd when trip point exceeded
- [ ] Add ACPI fan device support (`_FAN` objects)
- [ ] Wire thermald fan control
#### 1.4 Add Basic Sensor Drivers (2 weeks)
- [ ] Create `scheme:hwmon` or extend `/scheme/acpi/thermal`
- [ ] Port `coretemp` driver (Intel CPU temperature MSR)
- [ ] Port `k10temp` driver (AMD CPU temperature MSR)
- [ ] Add temperature readout to `redbear-info`
- [ ] Validate sensor readings on bare metal
### Phase 2: USB Completeness (4–6 weeks)
**Goal**: USB keyboard and storage work on all bare metal.
#### 2.1 EHCI Host Controller (3 weeks)
- [ ] Implement EHCI HCD based on Linux `drivers/usb/host/ehci-hcd.c`
- [ ] Support USB 2.0 high-speed keyboards, mice, storage
- [ ] Integrate with driver-manager config
- [ ] Validate on Intel and AMD bare metal
#### 2.2 OHCI/UHCI Fallback (2 weeks)
- [ ] Implement OHCI for AMD/VIA systems
- [ ] Implement UHCI for Intel legacy systems
- [ ] Add companion controller topology support
#### 2.3 USB Boot Resilience (1 week)
- [ ] Ensure USB keyboard available before login prompt on all profiles
- [ ] Add USB storage boot support
- [ ] Hot-plug stress testing on real hardware
### Phase 3: IRQ / IOMMU / MSI-X Hardening (4–6 weeks)
**Goal**: Production-grade interrupt and DMA safety.
#### 3.1 MSI-X Adoption (2 weeks)
- [ ] Migrate `e1000d` to MSI-X
- [ ] Migrate `ided` to MSI-X (or document legacy-IRQ-only rationale)
- [ ] Add MSI-X fallback logging to all PCI drivers
- [ ] Validate on real hardware
#### 3.2 IOMMU Hardware Validation (2 weeks)
- [ ] AMD-Vi validation on real AMD hardware
- [ ] Implement Intel VT-d daemon (migrate from orphaned acpid DMAR)
- [ ] Replace `iommu_validate_msi_irq()` stub with real validation
- [ ] DMA map/unmap with IOMMU translation
#### 3.3 IRQ Quality (2 weeks)
- [ ] IRQ affinity validation per driver
- [ ] Interrupt coalescing for network/storage
- [ ] Spurious IRQ accounting improvement
### Phase 4: Observability & Logging (2–4 weeks)
**Goal**: Operator can diagnose system health.
#### 4.1 Structured Logging (2 weeks)
- [ ] Add JSON-structured log format option to logd
- [ ] Per-service log files in `/var/log/<service>/`
- [ ] Size-based log rotation (e.g., 10 MB per file)
- [ ] Time-based log retention (e.g., 7 days)
#### 4.2 Udev Rules Engine (2 weeks)
- [ ] Replace hardcoded rules with subset of Linux udev rules parser
- [ ] Event-driven hotplug via scheme notifications (replace polling)
- [ ] Persistent device database across reboots
#### 4.3 System Health Dashboard (1 week)
- [ ] `redbear-info` thermal/CPU/fan display tab
- [ ] Boot timeline persistence across switchroot
- [ ] Real-time CPU/memory/network metrics
### Phase 5: Hardware Validation Matrix (4–6 weeks)
**Goal**: Evidence-based support claims.
#### 5.1 Define Validation Targets
Minimum 4 hardware classes:
1. AMD desktop (Ryzen, discrete GPU)
2. Intel desktop (Core, integrated GPU)
3. AMD laptop (Ryzen mobile)
4. Intel laptop (Core mobile)
#### 5.2 Per-Target Checklist
For each target, validate and record:
- [ ] Boots to login prompt
- [ ] All CPU cores online (`SMP: N CPUs online` matches hardware)
- [ ] USB keyboard works at boot
- [ ] USB storage mounts
- [ ] Network (wired) obtains DHCP lease
- [ ] Temperature readable via `redbear-info`
- [ ] Shutdown succeeds cleanly
- [ ] Reboot succeeds cleanly
#### 5.3 Negative-Result Capture
- [ ] Document failures per target (e.g., "AMD X670E: AP startup timeout",
"Intel Raptor Lake: SMBIOS missing")
- [ ] Update this assessment with validation evidence
### Phase 6: Desktop Stack Continuation (Parallel)
**Goal**: Continue the CONSOLE-TO-KDE path on top of hardened substrate.
This phase is **orthogonal** to the low-level work above. It depends on:
- Qt6Quick/QML downstream proof (unblocks kirigami)
- Real KWin build
- GPU CS ioctl backend + Mesa HW cross-compile
See `CONSOLE-TO-KDE-DESKTOP-PLAN.md` for detailed desktop path planning.
---
## 6. Stale Documents — Remove
The following documents are **superseded** by this assessment and should be
removed from `local/docs/`:
| File | Reason |
|------|--------|
| `IMPLEMENTATION-MASTER-PLAN.md` | Master plan role now covered by CONSOLE-TO-KDE v4.1 and this doc |
| `SUBSYSTEM-ASSESSMENT-2026-05.md` | Assessment consolidated here with broader scope |
| `SMP-BOOT-HARDENING-PLAN.md` | SMP issues and fixes incorporated here; detailed issue list can be referenced from git history |
| `CPU-DMA-IRQ-MSI-SCHEDULER-FIX-PLAN.md` | MSI Phase 1 is complete; remaining DMA/scheduler work tracked here |
| `COMPREHENSIVE-BOOT-IMPROVEMENT-PLAN.md` | Boot issues consolidated into this assessment |
**Canonical documents that remain authoritative**:
- `ACPI-IMPROVEMENT-PLAN.md` — detailed ACPI wave execution
- `IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md` — PCI/IRQ/MSI-X details
- `USB-IMPLEMENTATION-PLAN.md` — USB phase execution
- `CONSOLE-TO-KDE-DESKTOP-PLAN.md` — desktop path
- `DRM-MODERNIZATION-EXECUTION-PLAN.md` — GPU stack
- `WIFI-IMPLEMENTATION-PLAN.md` — Wi-Fi architecture
- `BLUETOOTH-IMPLEMENTATION-PLAN.md` — Bluetooth stack
- `DBUS-INTEGRATION-PLAN.md` — D-Bus architecture
- `GREETER-LOGIN-IMPLEMENTATION-PLAN.md` — greeter design
- `QUIRKS-SYSTEM.md` — quirk infrastructure
- `PATCH-GOVERNANCE.md` — patch workflow
- `BUILD-SYSTEM-HARDENING-PLAN.md` — build system
---
## 7. Evidence Model
This assessment uses the same evidence vocabulary as the canonical subsystem
plans:
| Class | Meaning |
|-------|---------|
| **Source-visible** | Behavior visible in checked-in source |
| **Build-visible** | Code compiles and stages in current build |
| **QEMU-validated** | Behavior exercised successfully in QEMU |
| **Runtime-validated** | Behavior exercised in real boot/runtime |
| **Hardware-validated** | Behavior proven on named bare-metal hardware |
| **Negative-result-documented** | Failures and gaps are explicitly recorded |
**No subsystem in this assessment is marked "hardware-validated"** because no
component has been proven on real bare metal with the rigor defined in
`ACPI-IMPROVEMENT-PLAN.md` Wave 7.
---
## 8. Definition of Done
This plan is complete when:
1. SMP brings up all cores reliably on AMD and Intel bare metal
2. C-states reduce idle power consumption measurably
3. ACPI thermal zones are readable and thermald responds to trip points
4. At least 2 sensor drivers report temperature on bare metal
5. EHCI driver enables USB keyboard on systems without xHCI routing
6. MSI-X is adopted by all new PCI drivers; legacy IRQ is documented fallback
7. IOMMU validates on at least one AMD and one Intel platform
8. Logging has rotation and per-service separation
9. Udev-shim supports event-driven hotplug
10. A validation matrix with 4+ hardware targets is published and maintained
---
*End of assessment.*
local/docs/CPU-DMA-IRQ-MSI-SCHEDULER-FIX-PLAN.md
-158
View File
@@ -1,158 +0,0 @@
# Red Bear OS — CPU/DMA/IRQ/MSI/Scheduler Fix Plan
**Date**: 2026-05-04
**Updated**: 2026-05-04 (MSI T1.1–T2.2 implemented, committed, pushed)
**Status**: Active — MSI Phase 1 complete, DMA/Scheduler pending
**Source of truth**: Linux kernel 7.0 (local/reference/linux-7.0/)
## 1. Problem Statement
Five critical integration gaps in the microkernel architecture:
| Gap | Severity | Impact | Status |
|-----|----------|--------|--------|
| MSI absent from kernel | CRITICAL | All NVMe/GPU/NIC on legacy INTx | ✅ RESOLVED (P8-msi.patch) |
| DMA/IOMMU not integrated | CRITICAL | DMA buffers unprotected | ⏳ Pending |
| PIT tick (148Hz) vs LAPIC (1000Hz) | HIGH | Scheduler 6x slower than Linux | ✅ RESOLVED (P7-scheduler patch) |
| Global scheduler lock | HIGH | Serializes all context switches | ✅ RESOLVED (work-stealing) |
| Thread creation (3 IPC hops) | HIGH | 3x slower than Linux clone() | ⏳ Pending |
## 2. Phase 1: MSI/MSI-X in Kernel (Week 1-3) ✅ COMPLETE
### T1.1: MSI Capability Parsing ✅ DONE
- File: `kernel/src/arch/x86_shared/device/msi.rs` (61 lines)
- Commit: `678980521` in `P8-msi.patch`
- Linux ref: `arch/x86/kernel/apic/msi.c` (391 lines)
- Implements: `MsiMessage` (compose/validate), `MsiCapability` (parse 32/64-bit), `MsixCapability` (parse table/PBA), `is_valid_msi_address`, `is_valid_msi_vector`
- Bounds-safe: all `parse()` methods return `Option<Self>`, using `.get()` instead of raw indexing
### T1.2: Vector Allocation Matrix ✅ DONE
- File: `kernel/src/arch/x86_shared/device/vector.rs` (53 lines)
- Commit: `678980521` in `P8-msi.patch`
- Linux ref: `arch/x86/kernel/apic/vector.c` (1387 lines)
- Implements: per-CPU bitmatrix (7×32-bit banks = 224 vectors 32-255), `allocate_vector`, `free_vector`
- Lock-free CAS-based allocation with `trailing_ones()` find-first-zero
- NOTE: VECTORS table is global (not yet per-CPU sharded) — sufficient for 224 vectors
### T1.3: MSI IRQ Domain (Scheme Integration) ✅ DONE
- File: `kernel/src/scheme/irq.rs`
- Commit: `678980521` in `P8-msi.patch`
- Implements: `msi_vector_is_valid()` (32-0xEF range check), `iommu_validate_msi_irq()` hook (stub: always true), IOMMU gate at `irq_trigger()` for vectors ≥16
### T1.4: Userspace MSI Consumer (driver-sys) ✅ DONE
- File: `local/recipes/drivers/redox-driver-sys/source/src/irq.rs`
- Commit: `678980521`
- Implements: `MsiAllocation` with round-robin CPU allocation, `irq_set_affinity` (scheme write), `program_x86_message` with kernel-mediated address/vector validation (mask `0xFFF0_0000`)
- Quirk-aware fallback retained: FORCE_LEGACY, NO_MSI, NO_MSIX
### T1.5: Kernel-side MSI Affinity Handler ✅ DONE
- File: `kernel/src/scheme/irq.rs`
- Commit: `678980521` in `P8-msi.patch`
- Implements: `Handle::IrqAffinity { irq, mask }` variant, path routing for `<irq>/affinity` and `cpu-XX/<irq>/affinity`, kwrite validates CPU id and stores mask atomically, kfstat/kfpath/kreadoff/close all handle new variant
## 3. Phase 2: DMA/IOMMU Integration (Week 3-5) — AUDITED 2026-05-04
**Status**: IOMMU daemon (1003 lines) and DmaBuffer (261 lines) already exist and are solid. Tasks re-scoped from "create" to "wire."
### T2.1: IommuDmaAllocator (driver-sys) ⏳ P0
- File: `local/recipes/drivers/redox-driver-sys/source/src/dma.rs`
- Add `IommuDmaAllocator` struct: holds IOMMU domain fd, wraps `DmaBuffer::allocate()` with IOMMU MAP opcode
- Uses `scheme:iommu/domain/N` write with MAP request → get IOVA
- Linux ref: `include/linux/dma-mapping.h` — `dma_alloc_coherent()` → `iommu_dma_alloc()`
### T2.2: GPU DMA pass-through ⏳ P0
- Wire `redox-drm` GPU drivers to open IOMMU device endpoint and use IommuDmaAllocator
- amdgpu: VRAM/GTT allocations through IOMMU domain
- Intel i915: GTT pages through IOMMU domain
- Files: `local/recipes/gpu/redox-drm/source/`, `local/recipes/gpu/amdgpu/source/`
### T2.3: Streaming DMA (linux-kpi) ⏳ P1
- `dma_map_single()`: allocate bounce buffer, copy data, map through IOMMU
- `dma_unmap_single()`: copy back, unmap, free bounce buffer
- Linux ref: `kernel/dma/mapping.c` — streaming API
- File: `local/recipes/drivers/linux-kpi/source/`
### T2.4: NVMe DMA pass-through ⏳ P1
- Wire `ahcid`/`nvmed` PRP list physical addresses through IOMMU domain
- Linux ref: `drivers/nvme/host/pci.c` — `nvme_map_data()`
### T2.5: SWIOTLB Fallback (low priority) ⏳ P2
- Linux ref: `kernel/dma/swiotlb.c`
- Bounce buffer for devices with <4GB DMA addressing
- Only needed for ancient hardware; x86_64 modern hardware doesn't need it
## 4. Phase 3: Scheduler Improvements (Week 4-6) — MOSTLY DONE
### T3.1: LAPIC Timer as Primary Tick ✅ DONE
- P7-scheduler-improvements.patch: LAPIC timer calibrated + enabled at vector 48
- TSC-deadline mode, 1000Hz tick drives DWRR scheduler directly
- PIT fallback retained
### T3.2: Per-CPU Scheduler Locks ✅ DONE
- Work-stealing load balancer in switch.rs
- Per-CPU nr_running counter
- Idle CPUs steal work via IPI
### T3.3: Load Balancing ✅ DONE
- RT scheduling class (priority 0-9, skip DWRR, immediate dispatch)
- Threshold reduced: 3→1 ticks for LAPIC-driven mode
- Geometric weights in DWRR
### T3.4: RT Scheduling Class ✅ DONE
### T3.5: NUMA-Aware Scheduling ❌
- Not implemented — low priority for desktop/non-NUMA systems
- Linux ref: kernel/sched/rt.c
- FIFO and Round-Robin classes
- Priority inheritance
- RT throttling: 95% CPU cap/sec
### T3.5: TSC-Deadline Timer
- Use IA32_TSC_DEADLINE MSR for precise tick
- True tickless operation
- TSC calibration via HPET or PIT
## 5. Phase 4: Thread Creation (Week 6-7)
### T4.1: Batched Thread Creation
- Batch new-thread requests (reduce IPC)
- Pre-allocate stack pages during fork
### T4.2: Kernel Thread Pool
- Pre-create idle kernel threads
- Reuse via object pool
### T4.3: Shared Memory IPC
- Use shm for proc scheme bulk ops
- Avoid data copy through IPC channel
## 6. Dependencies
Phase 1 (MSI): T1.1 -> T1.2 -> T1.3 -> T1.4 -> T1.5
Phase 2 (DMA): T2.1 -> T2.2 -> T2.3 -> T2.4 -> T2.5
Phase 3 (Sched): T3.1 -> T3.5 -> T3.2 -> T3.3 -> T3.4
Phase 4 (Thread): T4.1 -> T4.2 -> T4.3
Phase 1+2 independent (parallel). Phase 2.4 needs Phase 1.3.
Phase 3.1 partially done (start immediately).
## 7. Timeline
| Phase | Duration | Cumulative |
|-------|----------|------------|
| Phase 1 (MSI) | 3 weeks | Week 3 |
| Phase 2 (DMA/IOMMU) | 3 weeks | Week 5 |
| Phase 3 (Scheduler) | 3 weeks | Week 7 |
| Phase 4 (Threads) | 2 weeks | Week 7 |
Total: 7 weeks (2 devs parallel Phase 1+2)
## 8. Success Metrics
| Metric | Before | After |
|--------|--------|-------|
| Scheduler tick | 148Hz (PIT) | 1000Hz (LAPIC) |
| NVMe throughput | INTx shared | MSI-X 4+ queues |
| Context switch | ~6.75ms | ~1ms |
| Thread create | 3 IPC hops | 2 IPC hops |
| DMA safety | Unprotected | IOMMU-mapped |
local/docs/IMPLEMENTATION-MASTER-PLAN.md
-385
View File
@@ -1,385 +0,0 @@
# Red Bear OS — Master Implementation Plan
**Date**: 2026-05-04
**Status**: Authoritative — supersedes CHANGELOG-DRIVER-IMPROVEMENT-PLAN.md, COMPREHENSIVE-DRIVER-AUDIT-2026-05-04.md, and HARDWARE-VALIDATION-MATRIX.md
**Source of truth**: Linux kernel 7.0 (`local/reference/linux-7.0/`)
---
## 1. Authority & Scope
### 1.1 Relationship to Existing Plans
This plan is the **master execution document**. It delegates subsystem authority to specialized plans:
| Plan | Subsystem | Relationship |
|------|-----------|-------------|
| `ACPI-IMPROVEMENT-PLAN.md` | ACPI sleep, thermal, EC, power | **Authoritative** for ACPI |
| `IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md` | PCI IRQ, MSI-X, IOMMU, controllers | **Authoritative** for IRQ/PCI |
| `USB-IMPLEMENTATION-PLAN.md` | xHCI, EHCI, device lifecycle | **Authoritative** for USB |
| `DRM-MODERNIZATION-EXECUTION-PLAN.md` | GPU/DRM, KMS, Mesa | **Authoritative** for GPU |
| `BLUETOOTH-IMPLEMENTATION-PLAN.md` | BT host/controller | **Authoritative** for BT |
| `WIFI-IMPLEMENTATION-PLAN.md` | Wi-Fi control plane | **Authoritative** for Wi-Fi |
| `CONSOLE-TO-KDE-DESKTOP-PLAN.md` | Desktop/KDE path | **Authoritative** for desktop |
**This master plan covers**: storage, network, audio, input drivers, cross-cutting quality, CPU/power, virtio, and kernel substrate (CPU/SMP/timers/DMA/memory).
### 1.2 Validation Levels
- **builds** — compiles without error
- **enumerates** — discovers hardware via scheme interfaces
- **usable** — works in bounded scenario (QEMU or bare metal)
- **validated** — passes explicit acceptance tests with evidence
- **hardware-validated** — proven on real bare metal
---
## 2. Phase 0: Cross-Cutting Driver Quality (Week 1-2) ⏳ IMPLEMENTED
### T0.1: Driver Error Handling ✅
**Status**: DONE. All 5 critical driver main.rs files have zero `unwrap()` calls. 165-line durable patch at `local/patches/base/P6-driver-main-fixes.patch`.
**Files**: ahcid, e1000d, rtl8168d, ihdad, ac97d main.rs
### T0.2: Driver Logging
Not started. Drivers use inconsistent logging.
### T0.3: Driver Lifecycle Documentation
Not started.
---
## 3. Phase 1: Storage Drivers (Week 2-6) ⏳ STRUCTURE EXISTING
### T1.1: AHCI NCQ ✅ (71 lines, wired)
**Status**: DONE. `ahci/src/ahci/ncq.rs` (71 lines) with tag alloc, FIS construction, completion processing, NCQ enable/issue. Wired via `pub mod ncq` in mod.rs.
**Linux ref**: `drivers/ata/libata-sata.c` — `ata_qc_issue()`
**Remaining work**: Wire into port interrupt handler, runtime test with QEMU AHCI + NCQ.
### T1.2: AHCI Power Management ❌
**Linux ref**: `drivers/ata/libata-eh.c:3682` — `ata_eh_handle_port_suspend()`
### T1.3: AHCI TRIM/Discard ❌
**Linux ref**: `drivers/ata/libata-scsi.c` — `ata_scsi_unmap_xlat()`
### T1.4: NVMe Multiple Queues ❌
**Linux ref**: `drivers/nvme/host/pci.c` — `nvme_reset_work()`
---
## 4. Phase 2: Network Drivers (Week 4-8) ⏳ STRUCTURE EXISTING
### T2.1: e1000 ITR + Checksum ✅ (33 lines, wired)
**Status**: DONE. `e1000d/src/itr.rs` (33 lines) with ITR state machine, set_itr, configure_default, enable_rx_checksum, enable_tso. Wired via `pub mod itr` in main.rs.
**Linux ref**: `e1000e/netdev.c:4200` — `e1000_configure_itr()`
### T2.2: e1000 TSO ❌
### T2.3: r8169 PHY ✅ (34 lines, wired)
**Status**: DONE. `rtl8168d/src/phy.rs` (34 lines) with chip detection (12 variants), PHY registers, link detect, reset, autoneg + gigabit init. Wired via `pub mod phy` in main.rs.
**Linux ref**: `r8169_phy_config.c` (1,354 lines)
### T2.4: Jumbo Frames ❌
---
## 5. Phase 3: Audio Drivers (Week 6-10) ⏳ STRUCTURE EXISTING
### T3.1: HDA Codec Detection ✅ (STRUCTURE)
**Status**: DONE. `ihdad/src/hda/codec.rs` (18 lines) + `jack.rs` (4 lines). Both wired. 12 known codec table. Jack sense with pin config parsing.
### T3.2: HDA Jack Detection ✅ (STRUCTURE)
**Status**: `ihdad/src/hda/jack.rs` exists. Jack sense, unsolicited response.
### T3.3: HDA Stream Setup
Stream.rs exists (387 lines). NOT runtime-validated.
### T3.4: AC97 Multiple Codec ❌
---
## 6. Phase 4: Input Drivers (Week 3-5) ⏳ PARTIAL
### T4.1: PS/2 Controller Reset ❌
**Linux ref**: `drivers/input/serio/i8042.c:522`
### T4.2: Touchpad Protocols ❌
**Linux ref**: `drivers/input/mouse/synaptics.c`
---
## 7. Phase 5: Validation (Week 1-12, parallel) ⏳ IMPLEMENTED
### T5.1: Test Harnesses ✅
`local/scripts/test-storage-qemu.sh` and `test-network-qemu.sh` exist.
### T5.2: Hardware Validation Matrix ✅
`local/docs/HARDWARE-VALIDATION-MATRIX.md` — 28 lines tracking 18 components.
---
## 8. Kernel Substrate (Addendum A findings)
### K1: CPU / SMP / Timer (T0 priority)
| Gap | Linux Ref | Lines |
|-----|-----------|-------|
| BSP/AP handoff | `arch/x86/kernel/smpboot.c:895` | 1,511 |
| CPU hotplug | `smpboot.c:1312` | — |
| TSC calibration | `arch/x86/kernel/tsc.c:1186` | 1,612 |
| APIC timer calibration | `arch/x86/kernel/apic/apic.c:294` | 2,694 |
| Vector allocation | `arch/x86/kernel/apic/vector.c` | 1,387 |
| MSI/MSI-X | `arch/x86/kernel/apic/msi.c` | 391 | ✅ DONE — P8-msi.patch (msi.rs, vector.rs, scheme/irq.rs, driver-sys) |
### K2: DMA / IOMMU (Audited 2026-05-04)
**Current State — Thorough Audit:**
| Component | Location | Lines | Status |
|---|---|---|---|
| IOMMU scheme daemon | `local/recipes/system/iommu/source/src/lib.rs` | 1,003 | ✅ REAL — full AMD-Vi protocol: domain CRUD, MAP/UNMAP/TRANSLATE, device assignment, event drain, IRQ remapping. Host-runnable tests pass. |
| AMD-Vi unit driver | `local/recipes/system/iommu/source/src/amd_vi.rs` | 427 | ✅ REAL — IVRS parsing, MMIO mapping, device table programming, command buffer, event log, page table init |
| Domain page tables | `local/recipes/system/iommu/source/src/page_table.rs` | — | ✅ REAL — multi-level page table, IOVA allocation, mapping flags (R/W/X/coherent/user) |
| DMA buffer (alloc+phys) | `local/recipes/drivers/redox-driver-sys/source/src/dma.rs` | 261 | ✅ REAL — `DmaBuffer` with physically contiguous allocation via scheme:memory, virt-to-phys translation, heap fallback |
| linux-kpi DMA headers | `local/recipes/drivers/linux-kpi/source/` | — | ✅ dma-mapping.h, dma-direction.h, scatterlist.h ported |
| IOMMU←→driver wiring | — | — | ❌ **GAP** — `DmaBuffer` does NOT pass through IOMMU domains. GPU/NIC/NVMe drivers allocate DMA directly, not through IOMMU-isolated domains |
| Streaming DMA | — | — | ❌ **GAP** — no `dma_map_single`/`dma_unmap_single` for bounce-buffer ops |
| SWIOTLB | — | — | ❌ **GAP** — no bounce buffer for devices with limited DMA range |
**Implementation Plan — DMA/IOMMU Integration (Week 3-5):**
| Task | Description | Lines | Priority |
|---|---|---|---|
| **D2.1: IommuDmaAllocator** | New type in driver-sys: takes an IOMMU domain handle, allocates DmaBuffer through it. Uses `scheme:iommu/domain/N` MAP opcode. | ~150 | P0 |
| **D2.2: GPU DMA pass-through** | Wire `redox-drm` to use `IommuDmaAllocator` for GTT/VRAM allocations. Requires amdgpu/ihdgd to open IOMMU device handle. | ~80 | P0 |
| **D2.3: NVMe DMA pass-through** | Wire `ahcid`/`nvmed` PRP lists through `IommuDmaAllocator`. | ~60 | P1 |
| **D2.4: Streaming DMA** | `dma_map_single`/`dma_unmap_single` in linux-kpi. Allocates temp buffer, copies data, maps through IOMMU. | ~120 | P1 |
| **D2.5: SWIOTLB** | Bounce buffer allocation for DMA-limited devices. Linux ref: `kernel/dma/swiotlb.c`. | ~200 | P2 |
**Linux Reference Summary (from `local/reference/linux-7.0/`):**
| Linux API | Purpose | Red Bear Equivalent |
|---|---|---|
| `dma_alloc_coherent()` | Allocate physically contiguous, uncached DMA buffer | `DmaBuffer::allocate()` + `IommuDmaAllocator` (planned) |
| `dma_map_single()` | Map a single buffer for device DMA (cache sync) | Not yet — D2.4 |
| `dma_map_sg()` | Map scatter-gather list | Not yet |
| `iommu_domain_alloc()` | Create IOMMU translation domain | `IommuScheme` CREATE_DOMAIN opcode |
| `iommu_map()` | Map physical pages into domain | `IommuScheme` MAP opcode |
| `iommu_attach_device()` | Assign device to domain | `IommuScheme` ASSIGN_DEVICE opcode |
### K2b: Thread Creation / fork() (Audited 2026-05-04)
**Current State:**
| Component | Location | Lines | Status |
|---|---|---|---|
| Kernel `context::spawn` | `recipes/core/kernel/source/src/context/mod.rs:217` | ~25 | ✅ Creates new context with NEW address space, kernel stack, initial call frame |
| `scheme:user` process spawn | `recipes/core/kernel/source/src/scheme/user.rs:723` | — | ✅ Userspace writes process params → kernel spawns |
| relibc `rlct_clone` | `recipes/core/relibc/source/src/platform/redox/mod.rs:1154` | ~10 | ✅ Thread creation via `redox_rt::thread::rlct_clone_impl` — lightweight: shares address space, TCB, signal state |
| `pthread_create` | `recipes/core/relibc/source/src/pthread/mod.rs:105` | ~100 | ✅ Allocates stack via mmap, creates TCB, calls rlct_clone |
| Thread stack allocation | mmap-based (line 130-143) | — | ✅ MAP_PRIVATE | MAP_ANONYMOUS, correct |
**Gap Analysis:**
| Gap | Severity | Detail |
|---|---|---|
| No `clone()` syscall | MEDIUM | Redox uses `rlct_clone` for threads and `scheme:user` for processes. This is architecturally correct for a microkernel — no gap. |
| No `CLONE_VM` flag | N/A | `rlct_clone` implicitly shares address space (it's a THREAD clone, not a process clone). Process creation via `scheme:user` creates new address space. Correct semantics. |
| No `CLONE_FILES` | N/A | File descriptors are shared via the `scheme:user` write protocol. Re-layout possible but functional. |
| "3 IPC hops" slower than Linux | LOW | Measured: 1) mmap stack, 2) rlct_clone syscall, 3) synchronization mutex unlock. Linux `clone()` does all three in kernel. Acceptable for a microkernel. |
| No `posix_spawn()` fast-path | MEDIUM | Currently goes through `fork`-equivalent → `exec`. Linux has `posix_spawn` via `vfork`+`exec`. Not yet in Redox. |
**Overall verdict on DMA/IOMMU**: IOMMU daemon is the most complete userspace component — it needs wiring, not rewriting. DmaBuffer exists but is IOMMU-unaware. The implementation tasks (D2.1-D2.5) are wiring tasks connecting an already-working IOMMU to already-working driver allocators.
### K3: Virtio
| Gap | Linux Ref | Lines |
|-----|-----------|-------|
| Modern PCI transport | `drivers/virtio/virtio_pci_modern.c` | 1,301 |
| Packed virtqueue | `drivers/virtio/virtio_ring.c` | 3,940 |
| Multiqueue | `drivers/net/virtio_net.c` | 7,256 |
### K4: CPU Frequency / Thermal
| Component | Lines | Status |
|-----------|-------|--------|
| cpufreqd | 26 | STUB — needs MSR/governor implementation |
| thermald | 837 | REAL — needs trip points, fan control |
### K5: Block Layer
No shared block layer exists. Each storage driver reinvents I/O dispatch. Linux: `block/blk-mq.c` (5,309 lines).
---
## 9. ACPI Gaps (delegated to ACPI-IMPROVEMENT-PLAN.md)
| Linux File | Lines | Feature | Status |
|------------|-------|---------|--------|
| `drivers/acpi/sleep.c` | 1,152 | S3/S4 suspend | ❌ |
| `drivers/acpi/thermal.c` | 1,067 | Thermal zones | ❌ |
| `drivers/acpi/battery.c` | 1,331 | Battery status | ❌ |
| `drivers/acpi/ec.c` | 2,380 | EC runtime | ❌ |
| `drivers/acpi/fan.c` | ~400 | Fan control | ❌ |
| `arch/x86/kernel/acpi/sleep.c` | 202 | x86 sleep | ❌ |
---
## 10. Execution Priority
### Tier T0 — Kernel Substrate (CRITICAL — blocks all driver work)
| Task | Files | Estimated |
|------|-------|-----------|
| MSI/MSI-X support | kernel apic + irq.rs | 4-6 weeks |
| TSC calibration | kernel time + tsc | 1-2 weeks |
| DMA API | kernel dma | 2-3 weeks |
| Virtio modern PCI | virtio-core transport | 2-3 weeks |
| cpufreqd (real impl) | local cpufreqd | 2-3 weeks |
### Tier T1 — Storage + Network (HIGH)
| Task | Files | Estimated |
|------|-------|-----------|
| AHCI NCQ runtime | ahci ncq.rs + main.rs | 2-3 weeks |
| AHCI PM + TRIM | ahci new module | 1-2 weeks |
| e1000 ITR runtime | e1000 itr.rs + device.rs | 1-2 weeks |
| r8169 PHY runtime | r8169 phy.rs + device.rs | 1-2 weeks |
### Tier T2 — Audio + Input (MEDIUM)
| Task | Files | Estimated |
|------|-------|-----------|
| HDA codec runtime | ihdad hda/codec.rs | 2-3 weeks |
| HDA stream playback | ihdad hda/stream.rs | 2-3 weeks |
| PS/2 controller reset | ps2d controller.rs | 3-5 days |
| Touchpad protocols | ps2d mouse.rs | 1-2 weeks |
### Tier T3 — Completeness (LOW)
| Task | Files | Estimated |
|------|-------|-----------|
| NVMe multi-queue | nvmed | 2-3 weeks |
| e1000 TSO | e1000 | 1-2 weeks |
| Jumbo frames | e1000 + r8169 | 3-5 days |
| AC97 multi-codec | ac97d | 1 week |
---
## 11. Hardware Validation Matrix
| Component | QEMU | Bare Metal | Status |
|-----------|------|------------|--------|
| AHCI SATA | ✅ | 🔲 | NCQ structure present |
| NVMe | 🔲 | 🔲 | Basic driver |
| virtio-blk | ✅ | N/A | QEMU only |
| e1000 | 🔲 | 🔲 | ITR structure present |
| rtl8168 | 🔲 | 🔲 | PHY config present |
| virtio-net | ✅ | N/A | QEMU only |
| Intel HDA | 🔲 | 🔲 | Codec+jack added |
| AC97 | 🔲 | 🔲 | Basic driver |
| PS/2 | ✅ | 🔲 | QEMU works |
| VESA | ✅ | 🔲 | QEMU FB works |
| virtio-gpu | ✅ | N/A | 2D only |
| cpufreqd | 🔲 | 🔲 | STUB (26 lines) |
| thermald | 🔲 | 🔲 | ACPI thermal |
| x2APIC/SMP | ✅ | ✅ | Multi-core works |
---
## 12. File Inventory
### Patches (durable)
| Patch | Lines | Recipe | Status |
|-------|-------|--------|--------|
| `local/patches/relibc/P5-named-semaphores.patch` | 249 | relibc | ✅ Wired |
| `local/patches/base/P6-driver-main-fixes.patch` | 165 | base | ✅ Wired |
| `local/patches/base/P6-driver-new-modules.patch` | 185 | base | ✅ Wired |
| `local/patches/base/P6-cpufreqd-real-impl.patch` | 177 | — | 🔲 Not wired |
### New Source Files
| File | Lines | Phase | Status |
|------|-------|-------|--------|
| `ahcid/src/ahci/ncq.rs` | 12 | Phase 1 | ⚠️ Truncated |
| `e1000d/src/itr.rs` | 9 | Phase 2 | ⚠️ Truncated |
| `rtl8168d/src/phy.rs` | 5 | Phase 2 | ⚠️ Truncated |
| `ihdad/src/hda/codec.rs` | 4 | Phase 3 | ⚠️ Truncated |
| `ihdad/src/hda/jack.rs` | 5 | Phase 3 | ⚠️ Truncated |
| `cpufreqd/src/main.rs` | 26 | Kernel | ❌ STUB |
### Scripts
| Script | Phase | Status |
|--------|-------|--------|
| `local/scripts/test-storage-qemu.sh` | Phase 5 | ✅ |
| `local/scripts/test-network-qemu.sh` | Phase 5 | ✅ |
| `local/scripts/lint-config-paths.sh` | Phase 0 | ✅ |
| `local/scripts/validate-init-services.sh` | Phase 0 | ✅ |
| `local/scripts/validate-file-ownership.sh` | Phase 0 | ✅ |
| `local/scripts/generate-installs-manifest.sh` | Phase 0 | ✅ |
### Documentation
| Document | Lines | Status |
|----------|-------|--------|
| `IMPLEMENTATION-MASTER-PLAN.md` | — | This file |
| `CHANGELOG-DRIVER-IMPROVEMENT-PLAN.md` | 672 | Superseded |
| `COMPREHENSIVE-DRIVER-AUDIT-2026-05-04.md` | 316 | Superseded |
| `HARDWARE-VALIDATION-MATRIX.md` | 28 | Superseded |
| `BUILD-SYSTEM-HARDENING-PLAN.md` | 403 | Active |
| `BUILD-SYSTEM-INVARIANTS.md` | 436 | Active |
| `ACPI-IMPROVEMENT-PLAN.md` | 839 | Active |
| `IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md` | 916 | Active |
---
## 14. Scheduler & Threading Assessment (2026-05-04)
### Architecture
- **Kernel**: DWRR scheduler (577 lines), 40 priority levels, per-CPU queues, futex (222 lines)
- **Userspace**: proc manager (2,638 lines), pthread (440 lines), signal delivery via proc scheme
- **IPC bridge**: 3 round-trips for thread creation vs Linux's single clone() syscall
### Strengths
- DWRR with geometric weights, CPU affinity masks, soft-blocking with monotonic timeout
- Full POSIX process model (PID/PGID/SID, job control, orphan detection)
- Futex with physical-address keys for cross-process synchronization
### Critical Gaps
1. **PIT-based tick (~148Hz)** — LAPIC timer exists but `setup_timer()` is commented out. Should use Periodic/TscDeadline mode at 1000Hz.
2. **Global CONTEXT_SWITCH_LOCK** — spinlock serializes all context switches across CPUs. Should be per-CPU.
3. **No load balancing** — idle CPUs don't steal work from busy CPUs
4. **No RT scheduling** — missing FIFO/RR/Deadline classes
5. **No cgroups** — no CPU bandwidth control or resource limits
6. **Thread creation latency** — 3 IPC hops vs single clone()
| Tier | Duration |
|------|----------|
| T0 (kernel substrate) | 10-14 weeks |
| T1 (storage + network) | 6-10 weeks |
| T2 (audio + input) | 6-10 weeks |
| T3 (completeness) | 4-8 weeks |
| **Total (2 developers, parallel)** | **16-24 weeks** |
| **Total (1 developer, sequential)** | **26-42 weeks** |
local/docs/SMP-BOOT-HARDENING-PLAN.md
-357
View File
@@ -1,357 +0,0 @@
# Red Bear OS SMP Boot & Scheduler Hardening Plan
**Version**: 1.0 — 2026-05-16
**Status**: Active
**Canonical**: This document supersedes `SMP-SCHEDULER-IMPROVEMENT-PLAN.md` for forward work.
**Scope**: Kernel SMP, AP startup, x2APIC, per-CPU data, TLB shootdowns, IRQ routing, scheduler, userspace boot, daemon robustness.
## Assessment Summary
Comprehensive assessment of kernel SMP infrastructure (20 source files), userspace boot process (10 source files), and modern Intel/AMD MP specifications. Cross-referenced with Linux `smpboot.c`, Zircon `lk_main`, and seL4 multicore boot.
**Total issues found: 38 kernel + 16 userspace = 54 issues**
- Critical: 6 kernel + 3 userspace = 9
- High: 7 kernel + 4 userspace = 11
- Medium: 10 kernel + 5 userspace = 15
- Low: 15 kernel + 4 userspace = 19
---
## Kernel SMP Issues
### Critical (6)
| # | Issue | File | Root Cause |
|---|-------|------|------------|
| K1 | AP startup LogicalCpuId race | `madt/arch/x86.rs:153,244,276,365` | Two APs `CPU_COUNT.load(Relaxed)` → same ID → both `fetch_add(1)` |
| K2 | AP_READY dual-mechanism sync race | `madt/arch/x86.rs:174-225` | Trampoline u64 `ap_ready.write(0)` + static `AtomicBool AP_READY` — inconsistent ordering, UB on cast |
| K3 | TLB shootdown range race | `percpu.rs:134-137` | Concurrent shootdowns overwrite `tlb_flush_start`/`tlb_flush_count` between flag set and IPI |
| K4 | MCS lock missing memory fences | `sync/mcs.rs:74-101` | No Release after `next.store()`, no Acquire before `locked.load()` |
| K5 | Unbounded priority inversion chain | `sync/mcs.rs:126-145` | PI donation goes one level only; transitive chains unbounded |
| K6 | Scheduler context switch flag not cleared on panic | `switch.rs:164,298` | `in_context_switch` stays true → permanent CPU lockup |
### High (7)
| # | Issue | File | Root Cause |
|---|-------|------|------------|
| K7 | Missing SIPI timing delays | `madt/arch/x86.rs:192-337` | Spin-count delays, not TSC-based. Intel SDM requires 10ms INIT→SIPI |
| K8 | NUMA node set after CPU visible | `madt/arch/x86.rs:244,253` | `CPU_COUNT.fetch_add()` before `numa_node.set()` |
| K9 | Empty memory fence before AP starts | `madt/arch/x86.rs:188` | `asm!("")` is compiler barrier only, not hardware fence |
| K10 | TLB range Relaxed ordering | `percpu.rs:146,179` | Range stores use `Relaxed`, no barrier before IPI send |
| K11 | IOAPIC affinity no CPU online check | `ioapic.rs:126-137` | Accepts any ApicId without validation |
| K12 | MAX_CPU_COUNT=128 too small | `cpu_set.rs:44` | AMD EPYC has 128C/256T, Threadripper PRO 96C/192T |
| K13 | Global IRQ count lock | `scheme/irq.rs:67` | `COUNTS.lock()` is global spinlock on hot path |
### Medium (10)
| # | Issue | File | Root Cause |
|---|-------|------|------------|
| K14 | x2APIC detection no fallback | `local_apic.rs:56-66` | If x2APIC init fails, no fallback to xAPIC |
| K15 | AP startup timeout not time-based | `madt/arch/x86.rs:44` | `AP_SPIN_LIMIT=1_000_000` spin counts vary by clock speed |
| K16 | TLB shootdown no timeout | `percpu.rs:134-143` | Spin waits indefinitely if target CPU crashed |
| K17 | Broadcast shootdown sequential flag-setting | `percpu.rs:151-184` | O(n) flag set loop on 128+ core systems |
| K18 | PI donation write-once | `sync/mcs.rs:62` | Later higher-priority waiter doesn't update |
| K19 | PI donation Relaxed ordering | `sync/mcs.rs:142` | `pi_donated_prio.store(Relaxed)` may not be visible |
| K20 | Scheduler NUMA-unaware | `switch.rs:357-495` | `same_node()` exists but never used in work stealing |
| K21 | IOAPIC legacy IRQs always BSP | `ioapic.rs:392` | IRQs 0-15 hardcoded to BSP, no load balancing |
| K22 | RSDP no BIOS scan fallback | `rsdp.rs:19-48` | Only uses bootloader-supplied address |
| K23 | No SDT checksum validation | `acpi/mod.rs:94-180` | Only RSDP checksum verified, not child SDTs |
### Low (15)
K24–K38: Trampoline writable+executable, fixed trampoline address 0x8000, no SIPI delivery status check, no PercpuBlock cleanup on AP failure, PercpuBlock registration race, no NUMA barrier, hardcoded preemption timer, no preemption guard enforcement, no MCS recursive detection, scheduler recursion limitation, MADT unknown types silently ignored, no MADT revision check, no SLIT diagonal validation, RSDP length bounds too loose, no APIC ESR clear before SIPI.
---
## Userspace Boot Issues
### Critical (3)
| # | Issue | File | Root Cause |
|---|-------|------|------------|
| U1 | Init dependency deadlock | `redbear-mini.toml:244-256` | `00_intel-gpiod.service` has `default_dependencies=true` → circular wait with driver-manager |
| U2 | No service timeout | `service.rs:78-118` | Notify/Scheme types block forever if daemon hangs |
| U3 | Dependency cycle detection missing | `scheduler.rs:77-95` | BFS `load_units()` loops forever on circular `requires_weak` |
### High (4)
| # | Issue | File | Root Cause |
|---|-------|------|------------|
| U4 | No daemon restart policy | init system | Crashed daemons stay dead, no auto-restart |
| U5 | No crash cleanup | driver-manager | Spontaneous crash doesn't release scheme/PCI/IRQ |
| U6 | Boot timeline /tmp/ missing | `driver-manager main.rs:24` | Writes to `/tmp/...` without ensuring `/tmp` exists |
| U7 | Hotplug redundant enumeration | `hotplug.rs:31-40` | Full PCI/ACPI re-scan every 2s |
### Medium (5)
U8–U12: Hotplug unbound device removal bug, ided I/O privilege `expect()`, serial boot markers blocking 800ms, limited parallelism (50/step), no queue overflow handling.
### Low (4)
U13–U16: PCI enumeration no timeout, async enumeration no join timeout, boot status command broken if no timeline, no driver health endpoint.
---
## Reference: Modern Hardware Requirements
Sources: Intel 64/IA-32 SDM Vol 3A Ch 8, AMD64 APM Vol 2 Ch 7, ACPI 6.5, Intel x2APIC spec, Linux smpboot.c, Zircon lk_main, seL4 multicore boot.
### AP Startup Timing (Intel SDM)
- INIT deassert → SIPI: **10ms** (modern CPUs: can be shorter)
- SIPI #1 → SIPI #2: **10-300µs** (modern: 10µs, legacy: 300µs)
- AP response timeout: **10 seconds** (Linux)
- ESR check: Clear before each SIPI, read after to verify acceptance
### AP Startup Timing (AMD)
- Similar INIT/SIPI sequence
- CPUID leaf `0x8000001E` for topology (ext_apic_id, core_id, node_id)
- CPUID leaf `0x1F` preferred for V2 extended topology (Intel + newer AMD)
- APIC ID may exceed 255 → x2APIC mandatory
### x2APIC Requirements
- **Mandatory**: CPU count > 255 (8-bit APIC ID exhausted)
- **Detection**: CPUID.01H:ECX[bit 21]
- **ICR**: Single 64-bit MSR write (vs two 32-bit MMIO writes)
- **No delivery status bit**: Hardware guarantees delivery
- **Self-IPI**: Dedicated MSR 0x83F (fastest single-IPI path)
### ACPI MADT Entry Types (ACPI 6.5)
- Type 0: Processor Local APIC (legacy 8-bit)
- Type 1: I/O APIC
- Type 2: Interrupt Source Override
- Type 4: Local APIC NMI
- Type 5: Local APIC Address Override
- **Type 9: Processor Local x2APIC** (32-bit ID, required for modern hardware)
- **Type 10: Local x2APIC NMI**
- Type 20: Multi-Processor Wakeup Structure (ACPI 6.4+)
### Common Firmware Bugs
1. Duplicate APIC IDs in MADT
2. Incorrect enabled flags
3. Missing entries (CPU exists but no MADT entry)
4. MADT UID / DSDT _UID mismatch
5. SLIT diagonal != 10 (Linux validates and rejects)
6. SRAT-SLIT inconsistency
### Linux Best Practices
- Parallel AP bringup (all APs kicked simultaneously) — reduces boot 500ms→100ms on 96-core
- Adaptive SIPI timing: `init_udelay=0` → 10µs for modern CPUs
- 10-second timeout with `schedule()` yield loop
- ESR check after each SIPI, retry up to 2×
- `cpu_callout_mask` / `cpu_callin_mask` handshake
### Zircon Best Practices
- Phased initialization: BSP → topology → AP release → AP init → sync
- 30-second startup timeout, OOPS (not panic) on timeout
- Idle threads pre-allocated before releasing APs
- Init levels coordinate initialization order
### seL4 Best Practices
- Single atomic write releases all APs simultaneously
- Explicit cache maintenance for ARM32
- Big kernel lock for simplicity (not scalable)
- BOOT_BSS section for boot-time variables
---
## Improvement Plan — Patch Series
### Priority 0: Fix All Discovered Issues (P15)
#### P15-1: AP Startup LogicalCpuId Race Fix (Critical K1)
**Files**: `src/acpi/madt/arch/x86.rs`
**Change**: Replace `CPU_COUNT.load(Relaxed)` + `LogicalCpuId::new(next_cpu)` + `CPU_COUNT.fetch_add(1)` with single `let cpu_id = LogicalCpuId::new(CPU_COUNT.fetch_add(1, SeqCst))`. Remove separate load. Move all pre-startup setup (PercpuBlock init, NUMA node set) to between allocation and `fetch_add`.
**Risk**: Low. Standard atomic fix.
**Verification**: Boot with 4+ CPUs, verify all get unique IDs.
#### P15-2: AP_READY Sync Consolidation (Critical K2)
**Files**: `src/acpi/madt/arch/x86.rs`
**Change**: Replace dual mechanism with single `AtomicU8` at TRAMPOLINE+8. AP writes 1 when ready. BSP polls with SeqCst. Add `fence(SeqCst)` before/after writing trampoline args to ensure AP sees them.
**Risk**: Medium. Changes trampoline protocol.
**Verification**: Boot test on QEMU, verify all APs start correctly.
#### P15-3: TLB Shootdown Range Race Fix (Critical K3)
**Files**: `src/percpu.rs`
**Change**: Pack range into single `AtomicU64` (bits [63:32] = start page, bits [31:0] = count). Single atomic `swap` sets flag + range atomically. Handler unpacks with single `load`.
**Risk**: Medium. Affects all TLB shootdowns.
**Verification**: Multi-core stress test with frequent mmap/munmap.
#### P15-4: MCS Lock Memory Ordering (Critical K4)
**Files**: `src/sync/mcs.rs`
**Change**: Add `fence(Release)` after `next.store(new_node, Relaxed)` at line 55. Add `fence(Acquire)` before `locked.load(Relaxed)` at line 59. Change PI donation store to `Release`.
**Risk**: Low. Standard lock ordering fix.
**Verification**: Multi-threaded contention test.
#### P15-5: NUMA Node Before CPU Visible (High K8)
**Files**: `src/acpi/madt/arch/x86.rs`
**Change**: Move `record_apic_mapping()` and `percpu.numa_node.set()` BEFORE `CPU_COUNT.fetch_add()`. Add `fence(SeqCst)` between them so scheduler sees NUMA data.
**Risk**: Low. Reordering of operations.
**Verification**: Boot with QEMU SRAT, verify NUMA nodes set before scheduler sees CPUs.
#### P15-6: Init Dependency Deadlock Fix (Critical U1)
**Files**: `config/redbear-mini.toml`, `config/redbear-full.toml`
**Change**: Add `default_dependencies = false` to `00_intel-gpiod.service`, `00_i2c-dw-acpi.service`, `00_i2c-gpio-expanderd.service`, `00_i2c-hidd.service`, `ucsid.service`. Add explicit `requires_weak` for actual dependencies only.
**Risk**: Low. Config-only change.
**Verification**: Boot redbear-mini, verify all services start without deadlock.
#### P15-7: Service Timeout Mechanism (Critical U2)
**Files**: `recipes/core/base/source/init/src/service.rs`, `recipes/core/base/source/init/src/scheduler.rs`
**Change**: Add `timeout_secs: Option<u32>` to Notify and Scheme variants. Use `set_read_timeout()` on INIT_NOTIFY pipe. On timeout, log error and mark service failed. Boot continues.
**Risk**: Medium. Changes init behavior.
**Verification**: Create a service that never notifies, verify boot continues after timeout.
#### P15-8: Dependency Cycle Detection (Critical U3)
**Files**: `recipes/core/base/source/init/src/scheduler.rs`
**Change**: Add `BTreeSet<UnitId>` visited tracking in `load_units()`. If a unit ID is already in the visiting set, log cycle error and skip.
**Risk**: Low. Defensive programming.
**Verification**: Create circular dependency in test config, verify detection.
#### P15-9: Boot Timeline /tmp/ Creation (Medium U6)
**Files**: `local/recipes/system/driver-manager/source/src/main.rs`
**Change**: Add `let _ = std::fs::create_dir_all("/tmp");` at top of `main()`, before `reset_timeline_log()`.
**Risk**: Trivial.
**Verification**: Boot, verify timeline file created.
#### P15-10: TLB Range Ordering Fix (High K10)
**Files**: `src/percpu.rs`
**Change**: Change `tlb_flush_start`/`tlb_flush_count` stores from `Relaxed` to `Release`. Change handler loads from `Relaxed` to `Acquire`.
**Risk**: Low. Ordering fix.
**Verification**: Multi-core TLB stress test.
---
### Priority 1: Stabilize SMP Boot (P16)
#### P16-1: Calibrated SIPI Delays (High K7)
**Files**: `src/acpi/madt/arch/x86.rs`
**Change**: Implement `udelay(us)` using TSC (calibrated during early boot). Replace spin-count delays: 10ms INIT→SIPI, 10µs SIPI→SIPI for modern CPUs.
**Reference**: Linux `wakeup_secondary_cpu_via_init()`, Intel SDM Vol 3A §8.4.
#### P16-2: AP Startup Error Status Check (Medium)
**Files**: `src/acpi/madt/arch/x86.rs`
**Change**: After each SIPI, clear and read APIC ESR. If delivery error, retry. Log failure for each CPU. Continue boot with available CPUs.
**Reference**: Linux checks `send_status` + `accept_status`.
#### P16-3: MAX_CPU_COUNT Increase (High K12)
**Files**: `src/cpu_set.rs`
**Change**: Increase `MAX_CPU_COUNT` from 128 to 256. Add boot-time warning if CPUs approach limit.
#### P16-4: AP Startup Graceful Degradation
**Files**: `src/acpi/madt/arch/x86.rs`
**Change**: If AP fails trampoline or AP_READY timeout, log warning, skip CPU, continue boot. Track `cpu_online` mask separately from `cpu_possible`.
#### P16-5: Firmware Bug Detection
**Files**: `src/acpi/madt/mod.rs`, `src/acpi/mod.rs`
**Change**: Add duplicate APIC ID detection during MADT parsing. Add SDT checksum validation (`sum all bytes == 0`). Log warnings for unknown MADT entry types. Cross-reference MADT entries with SRAT for consistency.
---
### Priority 2: Desktop-Safe Scheduler (P17)
#### P17-1: NUMA-Aware Work Stealing (Medium K20)
**Files**: `src/context/switch.rs`
**Change**: In `select_next_context()`, prefer contexts on same NUMA node. Use `numa::topology().same_node()`. Apply penalty for cross-node stealing. Use SLIT distance matrix for weight.
#### P17-2: Transitive Priority Inheritance (Critical K5)
**Files**: `src/sync/mcs.rs`
**Change**: When donating priority to lock holder, check if holder is waiting on another MCS lock. Propagate donation transitively up to 4 levels deep (bounded). Add lock graph cycle detection.
#### P17-3: CPU Affinity (New Feature)
**Files**: `src/context/context.rs`, `src/context/switch.rs`
**Change**: Add `affinity: LogicalCpuSet` to Context. Scheduler respects mask. Default: all CPUs. Add `sched_setaffinity` syscall.
#### P17-4: Preemption Latency Bounds
**Files**: `src/context/switch.rs`
**Change**: Replace hardcoded `new_ticks >= 3` with configurable interval. Enforce `preempt_locks > 0` guard at context switch. Add preemption-safe lock wrappers.
#### P17-5: Load Balancing
**Files**: `src/context/switch.rs`
**Change**: Periodic (every 100ms) load rebalancing. Migrate tasks from CPUs with >2 runnable to idle CPUs. Use NUMA distance for cross-node decisions.
---
### Priority 3: Harden IPC & Scheme Servers (P18)
#### P18-1: Daemon Restart Policy (High U4)
**Files**: `recipes/core/base/source/init/src/service.rs`, `recipes/core/base/source/init/src/scheduler.rs`
**Change**: Add `restart = "on-failure" | "always" | "never"` to service config. Implement exponential backoff: 1s → 2s → 4s → 8s → 30s max. Track restart count, give up after 5 consecutive failures.
#### P18-2: Process Monitoring & Cleanup (High U5)
**Files**: `local/recipes/system/driver-manager/source/src/config.rs`
**Change**: Non-blocking `waitpid(WNOHANG)` poll in hotplug loop. On driver exit: release scheme, unbind PCI device, free IRQ. Notify init of failure.
#### P18-3: Bounded Scheme Request Queues (Medium)
**Change**: Add configurable queue depth limit to scheme daemons. When full, return EBUSY. Prevents memory exhaustion.
#### P18-4: Watchdog/Health Monitoring (High)
**Change**: Optional health-check ping in scheme protocol. Init checks critical services every 5s. On failure, restart per restart policy.
---
### Priority 4: Stress-Test Userspace Drivers (P19)
#### P19-1: Multi-Core Driver Stress Test
**Change**: Parallel I/O to ided/ahcid/nvmed + network e1000d + input evdevd. Verify no panics, no hangs, no data corruption over 1 hour.
#### P19-2: GPU Parallel Submission
**Change**: Multiple processes submit to virtio-gpu / redox-drm simultaneously. Verify fencing correctness, no GPU hang.
#### P19-3: USB Hotplug Under Load
**Change**: Rapid device connect/disconnect while transferring data via usbscsid. Verify cleanup and no resource leaks.
#### P19-4: Hotplug Stress Test
**Change**: QEMU virtio device hot-add/hot-remove while system under load. Verify driver-manager handles changes correctly.
---
## Estimated Effort
| Priority | Patches | Lines | Time |
|----------|---------|-------|------|
| P0 (Fix discovered) | P15-1 through P15-10 | ~800 | 2-3 days |
| P1 (SMP stabilize) | P16-1 through P16-5 | ~500 | 2-3 days |
| P2 (Scheduler) | P17-1 through P17-5 | ~1200 | 5-7 days |
| P3 (IPC harden) | P18-1 through P18-4 | ~800 | 3-5 days |
| P4 (Stress test) | P19-1 through P19-4 | ~600 | 2-3 days |
| **Total** | **24 patches** | **~3900** | **14-21 days** |
## Acceptance Criteria
- [ ] All Critical and High issues resolved
- [ ] Boot to login prompt in <10s on QEMU (4 cores)
- [ ] No panics under 72-hour stress test (4 cores, all driver types)
- [ ] AP startup race-free with 128 simulated CPUs
- [ ] NUMA topology correctly discovered from QEMU SRAT
- [ ] Service restart within 5 seconds of crash
- [ ] No priority inversion >100ms under load
- [ ] All patches in `local/patches/kernel/`, wired into `recipe.toml`
- [ ] Boot-tested on QEMU UEFI with `scripts/run_mini.sh`
## Dependency Graph
```
P15-1 (CPU_COUNT race) ─────┐
P15-2 (AP_READY sync) ──────┤
P15-3 (TLB range race) ─────┤
P15-4 (MCS ordering) ───────┼──→ P16-1 (SIPI timing)
P15-5 (NUMA ordering) ──────┤ P16-2 (ESR check)
P15-10 (TLB ordering) ──────┘ P16-3 (MAX_CPU)
P16-4 (graceful degradation)
P15-6 (init deadlock) ──────────→ P16-5 (firmware bugs)
P15-7 (service timeout)
P15-8 (cycle detection)
P15-9 (/tmp creation)
P16-* ──→ P17-1 (NUMA work stealing)
P17-2 (transitive PI)
P17-3 (CPU affinity)
P17-4 (preemption)
P17-5 (load balancing)
P17-* ──→ P18-1 (restart policy)
P18-2 (crash cleanup)
P18-3 (bounded queues)
P18-4 (watchdog)
P18-* ──→ P19-* (stress tests)
```
local/docs/SUBSYSTEM-ASSESSMENT-2026-05.md
-328
View File
@@ -1,328 +0,0 @@
# Red Bear OS Subsystem Assessment vs Linux Reference
**Date:** 2026-05-17
**Scope:** Input devices, ACPI/PCID, Intel DRM/KMS, boot process
**Reference:** Linux kernel 7.1 (local/reference/linux-7.1/)
---
## Executive Summary
Red Bear OS has real, functional architectural scaffolding across all five subsystems. The critical gaps are in **hardware-facing paths that are stubbed or incomplete** — most notably Intel EDID/DDC, hardware vblank, display watermarks, AML interpreter depth, and boot dependency ordering. The single most impactful immediate fix is adding the missing `acpid` service to boot configs, which prevents ACPI-dependent drivers from enumerating correctly.
**Critical blockers for bare-metal desktop:**
1. Missing `acpid` service in redbear configs → ACPI devices never discovered
2. Intel `read_edid_block()` returns error → synthetic EDID is 112 bytes (should be 128) → no real monitor modes
3. Intel `get_vblank()` is a fake atomic counter → no real vblank for page flip synchronization
4. No display watermarks → FIFO underruns cause visible glitching
5. No boot dependency declarations → i2c-hidd/i2cd may race with acpid
---
## 1. Input Devices (Keyboard, Mouse, HID, I2C-HID, Touch)
### Current Implementation Inventory
| Component | Path | Quality | Key Notes |
|---|---|---|---|
| ps2d (PS/2) | `base/source/drivers/input/ps2d/` (5 files) | **Real** | Keyboard scancodes + mouse protocol. x86-only (non-x86 is `unimplemented!()`). Many TODOs, QEMU-specific hacks. No ImPS/2 scroll or trackpoint. |
| usbhidd (USB HID) | `base/source/drivers/input/usbhidd/` (2 files, 520 lines) | **Real** | Full HID report descriptor parsing, USB usage→orbclient scancode table, mouse relative+absolute, scroll, buttons. Retry with exponential backoff. Polling-based (1ms sleep loop). |
| i2c-hidd (I2C HID) | `base/source/drivers/input/i2c-hidd/` (5 files, 500+ lines) | **Real** | ACPI PNP0C50/ACPI0C50 device scan, _CRS resource parsing, _DSM HID descriptor address, I2C transfer via `/scheme/i2c/`. Probe failure quirk system with DMI matching. |
| intel-thc-hidd (Intel THC) | `base/source/drivers/input/intel-thc-hidd/` (3 files, 282 lines) | **Partial** | PCI init works, QuickI2C transport setup works, ACPI companion resolution works. **Main loop is `thread::sleep(Duration::from_secs(5))` — no input report streaming.** |
| inputd (multiplexer) | `base/source/drivers/inputd/` (3 files, 663 lines) | **Real** | Producer/consumer scheme, VT switching, keymap support (US/Dvorak/GB/AZERTY/Bepo/IT). ESTALE handoff for display driver transitions. |
| evdevd (evdev adapter) | `local/recipes/system/evdevd/` (5+ files) | **Real** | evdev scheme, device model, orbclient→evdev translation, gesture recognizer, key filter. |
| redbear-keymapd | `local/recipes/system/redbear-keymapd/` | **Real** | Keymap scheme registration and management. |
| udev-shim | `local/recipes/system/udev-shim/` | **Real** | Device node synthesis from scheme registrations, heuristic mapping. |
| I2C bus drivers | `base/source/drivers/i2c/` (5 modules) | **Real** | amd-mp2-i2cd, dw-acpi-i2cd, intel-lpss-i2cd, generic i2cd, i2c-interface library. |
| redbear-input-headers | `local/recipes/drivers/redbear-input-headers/` | **Real** | `linux/input.h`, `linux/input-event-codes.h`, `linux/uinput.h` — replaces policy-violating `linux-input-headers` from libevdev tarball. |
| libinput (WIP) | `local/recipes/libs/libinput/` | **WIP** | Port of upstream libinput with touchpad/trackpoint filtering. Not yet runtime-trusted. |
| libevdev (WIP) | `local/recipes/libs/libevdev/` | **WIP** | Port of upstream libevdev. |
### Gaps vs Linux
| Gap | Severity | Linux Reference | Red Bear Status |
|---|---|---|---|
| intel-thc-hidd doesn't stream | **High** | `drivers/hid/intel-thc-hid/` full probe+report streaming | Main loop sleeps 5s; no HID reports |
| No multitouch/ABS_MT | **High** | `drivers/input/input-mt.c` slot tracking, pointer emulation | Not implemented |
| No libinput acceleration/gestures | **High** | libinput: velocity curves, palm detection, gesture recognition | inputd does raw keymap only |
| No PS/2 extended protocols | **Medium** | `libps2.c` ImPS/2 scroll, Explorer 5-btn, trackpoint | Basic protocol only |
| No HID quirks table | **Medium** | `hid-quirks.c` 4000+ device entries | Only probe_failure quirks |
| No input hotplug | **Medium** | udev + inotify on `/dev/input/` | Static scan at startup |
| Polling-based USB HID | **Low** | URB interrupt-driven | 1ms sleep loop (functional but power-inefficient) |
| inputd keymap incompleteness | **Low** | Full xkb/keyboard-layout support | TODO for configurable keymap, AltGr, NumLock |
### Linux I2C-HID Reference (from local/reference/linux-7.1/)
The Linux I2C-HID probe sequence is:
1. Verify IRQ exists
2. Wake/power up device (_PS0/HID_POWER_ON)
3. Read HID descriptor from controller register
4. Read report descriptor
5. Parse descriptor
6. Size buffers from actual reports
7. Register IRQ
8. `hid_add_device()`
Red Bear's i2c-hidd follows this sequence correctly. The Intel THC driver does steps 1-5 but never reaches step 7-8.
---
## 2. ACPI and PCID
### Current Implementation Inventory
| Component | Path | Quality | Key Notes |
|---|---|---|---|
| Kernel ACPI | `kernel/source/src/acpi/` (9+ files) | **Real, partial** | RSDP, RSDT/XSDT, MADT, FADT, DSDT parsing. New: SLIT, SRAT. AML evaluation for basic methods (_STA, _PS0, _PS3, _INI). **No While/If-Else, no OperationRegion for PCI/I2C, no method locals.** |
| Kernel ACPI scheme | `kernel/source/src/scheme/acpi.rs` | **Real** | Exposes ACPI tables, symbols, resources, method evaluation to userspace. |
| Kernel DMAR/IOMMU | `kernel/source/src/acpi/dmar/` | **Partial** | DMAR table parsing for IOMMU. DRHD entries parsed but not wired to allocator. |
| Kernel sleep/S3 | `kernel/source/src/arch/x86_shared/sleep.rs` (new, uncommitted) | **New** | S3 suspend/wakeup assembly. Not yet wired to power management. |
| acpid | `base/source/drivers/acpid/` | **Real** | Scheme-based ACPI access, symbol evaluation, resource serialization. ESTALE-graceful handling. |
| pcid | `base/source/drivers/pcid/` | **Real** | PCI enumeration, config space, BAR mapping, pcid-spawner. MSI/MSI-X support via recent patches. |
| redox-driver-acpi | `local/recipes/drivers/redox-driver-acpi/` | **Real** | ACPI bus driver bridging ACPI discovery to pcid-spawner. |
| driver-manager | `local/recipes/system/driver-manager/` | **Real** | Manages PCI/ACPI driver matching and spawning. |
| redox-driver-sys quirks | `local/recipes/drivers/redox-driver-sys/source/src/quirks/` | **Real** | Compiled-in + TOML + DMI quirk tables. MSI/MSI-X fallback, DISABLE_ACCEL. |
| IOMMU daemon | `local/recipes/system/iommu/` | **Partial** | Builds, QEMU first-use proof passes. Real hardware validation pending. |
### Gaps vs Linux
| Gap | Severity | Linux Reference | Red Bear Status |
|---|---|---|---|
| AML interpreter incomplete | **Critical** | Full AML bytecode VM (While/If/Else, OperationRegion, Method locals, Notify) | Basic method calls only (_STA, _PS0, _PS3, _INI). No control flow. |
| No _PRW wake resources | **High** | `drivers/acpi/wakeup.c` | Not present |
| No thermal zones | **High** | `drivers/acpi/thermal.c` _TMP/_ACx/_PSV/_CRT | Not present |
| No ACPI battery | **Medium** | `drivers/acpi/battery.c` _BIF/_BST | Not present |
| No ACPI buttons | **High** | `drivers/acpi/button.c` LID/Power/Sleep | Not present |
| SRAT/SLIT not wired to NUMA | **Medium** | `mm/numa.c` | Parsed but not connected to page allocator |
| No _OSC OS capabilities | **Medium** | `drivers/acpi/osc.c` | Not present |
| No PCI ASPM | **Medium** | `drivers/pci/pcie/aspm.c` | Not present |
| No PCI hotplug | **Low** | `drivers/pci/hotplug/` | Not present |
| No suspend/resume | **Critical** | `drivers/acpi/sleep.c` S1-S5 | sleep.rs + wakeup.asm in uncommitted changes, not wired |
| DMAR/IOMMU path commented out | **High** | `drivers/iommu/intel-iommu.c` | `acpid/src/acpi/dmar/mod.rs` has iterator bug (`len_bytes` from wrong slice), hangs on real hardware — entire DMAR path commented out |
| DMI quirk matching dead | **High** | `/sys/firmware/dmi` | `redox-driver-sys/quirks/dmi.rs` depends on `/scheme/acpi/dmi` but that source doesn't exist in the ACPI stack |
| ACPI resource parsing panics | **Medium** | N/A | `redox-driver-acpi/resource.rs` and `prt.rs` panic on unexpected ACPI resource shapes instead of returning errors |
| `madt/arch/other.rs` stub | **Low** | `drivers/acpi/madt.c` | Non-x86 MADT handling is effectively unimplemented |
| PCI config: non-x86 `todo!()` | **Low** | `drivers/pci/` | `pcid/src/cfg_access/fallback.rs` has `todo!()` for non-x86 PCI config access |
| **Missing acpid service in configs** | **Critical** | N/A (config bug) | No `acpid = {}` in redbear-full.toml or redbear-device-services.toml |
### acpid Missing From Configs — Critical Bug
The boot process agent found that **no active `acpid = {}` service entry exists** in the redbear TOML configs. This means acpid may never start, which prevents ACPI symbol/resource discovery for all ACPI-dependent drivers (i2c-hidd, intel-thc-hidd, thermald, driver-manager ACPI path). This is the single highest-priority fix.
---
## 3. Intel DRM/KMS
### Current Implementation Inventory
| Component | Path | Quality | Key Notes |
|---|---|---|---|
| IntelDriver | `redox-drm/source/src/drivers/intel/mod.rs` (682 lines) | **Partial** | PCIe init, MMIO mapping, FORCEWAKE, connector detection, CRTC set_mode, page_flip, GEM create/mmap/close, IRQ handling. |
| IntelDisplay | `.../intel/display.rs` (404 lines) | **Partial** | Pipe detection, DDI port detection, mode setting (real HTOTAL/HBLANK/HSYNC/VTOTAL/VSYNC/PIPE_SRC register writes). **EDID: read_edid_block returns error → synthetic_edid(). DPCD: returns fake 4 bytes.** |
| IntelGtt | `.../intel/gtt.rs` | **Real** | GGTT allocation, mapping, unmapping. |
| IntelRing | `.../intel/ring.rs` (267 lines) | **Partial** | DMA ring buffer, GPU address binding. Only MI_FLUSH_DW + MI_NOOP submitted — no rendering commands. |
| DRM scheme | `redox-drm/source/src/scheme.rs` | **Real** | Full DRM/KMS ioctl surface. SETPLANE is empty, GETENCODER hardcoded. |
| KMS infrastructure | `redox-drm/source/src/kms/` (5 files) | **Real** | ConnectorInfo, ModeInfo with EDID parsing, synthetic_edid fallback. |
| Interrupt handling | `redox-drm/source/src/drivers/interrupt.rs` | **Real** | MSI/MSI-X/INTx setup, try_wait polling. |
| Linux-kpi DRM headers | `linux-kpi/source/src/c_headers/drm/` | **Minimal** | drm.h, drm_crtc.h, drm_gem.h, drm_ioctl.h — type definitions only. |
| ihdgd (legacy) | `base/source/drivers/graphics/ihdgd/` | **Old/Partial** | Separate Intel framebuffer driver. Many TODOs. Being superseded by redox-drm. |
| vesad | `base/source/drivers/graphics/vesad/` | **Legacy** | VESA framebuffer driver. No cursor support. |
| Mesa | `recipes/libs/mesa/` | **Software only** | Only swrast+virgl Gallium. No Intel iris/crocus/anv driver build. |
### Critical Bugs Found
1. **synthetic_edid() is 112 bytes, not 128** — `ModeInfo::from_edid()` requires `edid.len() >= 128` and checks for the 8-byte EDID header. The synthetic EDID is only 112 bytes so it always fails validation, forcing `default_1080p()` fallback on every Intel connector.
2. **Intel `get_vblank()` returns `AtomicU64::fetch_add(1, SeqCst)`** — This is NOT a real vblank counter. It increments on every IRQ regardless of display state. Real i915 reads the `PIPEFRAME` register (offset `0x70040 + pipe * 0x1000`) for per-pipe frame count.
### Gaps vs Linux i915
| Gap | Severity | Impact |
|---|---|---|
| EDID I2C/DDC stubbed | **Critical** | No real monitor modes — always falls back to synthetic/default |
| Vblank counter is fake | **Critical** | Page flip has no synchronization — tearing |
| Display watermarks absent | **Critical** | FIFO underruns → visible glitching on real hardware |
| No panel power sequencing | **High** | eDP panels won't turn on/off properly on laptops |
| No hardware cursor | **High** | No visible cursor in DRM mode |
| No DP AUX channel | **High** | No DisplayPort monitor support |
synthetic_edid too short (bug) | **Critical** | EDID validation always fails |
| No DMC firmware loading | **Medium** | No DC5/DC6 power state for Gen9+ |
| No HPD pulse detection | **Medium** | Monitor hotplug is crude |
| No render commands | **Medium** | Ring only does flush — no 2D/3D acceleration |
| No GGTT PTE invalidation | **Medium** | Stale TLB entries after GGTT updates |
| Mesa has no Intel driver | **High** | No hardware-accelerated OpenGL/Vulkan |
---
## 4. Boot Process
### Boot Sequence (as configured)
```
UEFI bootloader
→ kernel (startup, ACPI, scheme registration)
→ init (PID 1)
→ logd
→ scheme registration (memory, irq, event, pipe, debug, etc.)
→ numbered services from init.d/:
00_* : base daemons (ipcd, ptyd, randd)
02_* : driver-manager (or legacy pcid-spawner)
04_* : device drivers
06_* : D-Bus, sessiond, seatd
08_* : console/greeter
```
### Dependency Analysis
The `init` system supports `requires_weak` for service dependencies, but **most services don't declare dependencies**. The boot agent found:
- **`requires_weak`** means "if the dependency exists, wait for it; if not, proceed anyway." This is good for optional services but inadequate for strict ordering.
- **No explicit `acpid = {}` service** in redbear-full.toml or redbear-device-services.toml — ACPI-dependent drivers may never discover their devices.
- **`driver-manager`** retries deferred probes, but missing schemes (especially `acpi`) can leave drivers permanently skipped.
- **Greeter/session path works only** if dbus, seatd, redox-drm, and authd are all present. `redbear-greeterd` waits for Wayland socket, not a stronger compositor readiness signal.
### Gaps
| Gap | Severity | Notes |
|---|---|---|
| **Missing acpid service in configs** | **Critical** | No ACPI symbol discovery for i2c-hidd, thermald, driver-manager ACPI path |
| No dependency declarations | **High** | Services use number-based ordering only |
| No service readiness signaling | **High** | No sd_notify equivalent; init doesn't gate on daemon.ready() |
| No filesystem check | **Medium** | No fsck on boot; dirty filesystem mounts anyway |
| initfs→rootfs transition | **Medium** | No re-evaluation of service readiness after root switch |
---
## 5. Phased Implementation Plan
### Phase 1: Boot Dependency Fix (1–2 weeks)
**Priority: Unblocks everything downstream.**
| # | Task | Files | Complexity |
|---|------|-------|------------|
| 1.1 | Add `acpid = {}` to redbear-device-services.toml and redbear-full.toml | `config/redbear-device-services.toml`, `config/redbear-full.toml` | Low |
| 1.2 | Add `requires=` / `wants=` declarations to init service format | `recipes/core/base/source/init/src/` | Medium |
| 1.3 | Implement dependency-aware startup: wait for `scheme:<dep>` before starting dependents | `recipes/core/base/source/init/src/` | Medium |
| 1.4 | Add `provides= scheme:acpi` / `requires= scheme:acpi` to ACPI-dependent services | Service TOML files | Low |
| 1.5 | Wire ESTALE-retry into i2c-hidd/intel-thc-hidd as fallback (already partial) | `drivers/input/i2c-hidd/`, `intel-thc-hidd/` | Low |
### Phase 2: Intel Display Critical Fixes (3–5 weeks)
**Priority: Highest impact for bare-metal desktop.**
| # | Task | Complexity | Risk | Blocks |
|---|------|------------|------|--------|
| 2.1 | Implement I2C master-mode in i2cd | High | Medium | 2.2, 2.7, 3.1 |
| 2.2 | Implement real EDID via DDC (I2C at 0xA0). Fix synthetic_edid to 128 bytes as fallback | High | Medium | — |
| 2.3 | Implement hardware vblank (read PIPEFRAME register) | Medium | Low | — |
| 2.4 | Implement display watermarks (WM_LINETIME, WM levels per pipe) | High | Medium | — |
| 2.5 | Implement eDP panel power sequencing (PP_ON/OFF/CYCLE) | Medium | Medium | — |
| 2.6 | Implement hardware cursor (CUR_CTL/CUR_BASE/CUR_POS) | Medium | Low | — |
| 2.7 | Implement DP AUX channel (I2C-over-AUX for DisplayPort) | High | Medium | Depends on 2.1 |
**Ordering:** EDID (2.2) → vblank (2.3) → watermarks (2.4) → panel (2.5) → cursor (2.6) → DP AUX (2.7)
### Phase 3: Input Stack Completion (2–4 weeks)
**Can parallel with Phase 2 once I2C master-mode (2.1) is done.**
| # | Task | Complexity |
|---|------|------------|
| 3.1 | Complete intel-thc-hidd input streaming (replace sleep loop with HID report read) | Medium |
| 3.2 | Add PS/2 extended protocols (ImPS/2 scroll, Explorer 5-btn, trackpoint) | Medium |
| 3.3 | Add input device hotplug (dynamic producer registration in inputd) | Medium |
| 3.4 | Add multitouch protocol (ABS_MT slots, touch report parsing) | Medium |
| 3.5 | Add pointer acceleration to inputd | Low |
| 3.6 | Port bounded subset of Linux hid-quirks for device workarounds | Medium |
### Phase 4: AML Interpreter Depth (4–8 weeks)
**Risk gate: scope strictly to _PS0/_PS3/_PRW/_BIF/_BST opcodes first.**
| # | Task | Complexity |
|---|------|------------|
| 4.1 | AML While/If-Else/Method-with-locals (bounded, not full spec) | Very High |
| 4.2 | OperationRegion handlers for PCI config and I2C | High |
| 4.3 | _PRW (power resources for wake) | Medium |
| 4.4 | ACPI battery (_BIF/_BST) | Medium |
| 4.5 | ACPI buttons (LID, power, sleep) | Low |
| 4.6 | Thermal zone evaluation (_TMP, _ACx, _PSV, _CRT) | Medium |
### Phase 5: Advanced Features (4–8 weeks)
After Phases 2–4 are stable.
| # | Task |
|---|------|
| 5.1 | PCI ASPM power management (_OSC, L0s/L1) |
| 5.2 | PCI hotplug (acpiphp/pciehp) |
| 5.3 | SRAT/SLIT → NUMA allocator wiring |
| 5.4 | Display FIFO underrun recovery |
| 5.5 | HPD pulse detection |
| 5.6 | I2C bus error recovery (SMBus timeout, multi-controller) |
### Dependency Graph
```
Phase 1 (boot deps)
│
├──→ Phase 2 (Intel display) ──→ Phase 5.4, 5.5
│ │
│ └──→ 2.1 (I2C master) blocks 2.2, 2.7, 3.1
│
├──→ Phase 3 (input) ──→ 3.1 needs I2C (shared with 2.1)
│
├──→ Phase 4 (AML) ──→ Phase 5.1, 5.2
│ │
│ └──→ 4.1 gates 4.3–4.6
│
└──→ Phase 5 (advanced) ──→ depends on Phases 2, 3, 4
```
### Effort Estimate (2 developers)
| Phase | Duration | Parallelizable? |
|-------|----------|-----------------|
| Phase 1 | 1–2 weeks | Yes (with Phase 2 start) |
| Phase 2 | 3–5 weeks | Partially (2.1 blocks 2.2–2.7) |
| Phase 3 | 2–4 weeks | Yes (parallel with Phase 2) |
| Phase 4 | 4–8 weeks | Partially (4.1 gates rest) |
| Phase 5 | 4–8 weeks | After Phases 2–4 |
| **Total** | **14–27 weeks** | ~8–14 months |
### Key Risks
1. **I2C master-mode** is a shared dependency between EDID (2.2), THC input (3.1), and DDC (2.2). Implement it first in i2cd.
2. **AML interpreter scope creep** — the full AML spec is enormous. Strictly bound the first pass to opcodes needed for _PS0/_PS3/_PRW/_BIF/_BST. Fallback: bounded userspace AML evaluator in acpid.
3. **Intel watermark programming varies by generation** — start with Gen9 Skylake, then generalize.
4. **synthetic_edid 112-byte bug** must be fixed IMMEDIATELY — it affects every Intel display attempt.
5. **Missing acpid service** in configs must be fixed IMMEDIATELY — it blocks all ACPI-dependent device discovery.
6. **DMAR/IOMMU iterator bug** in `acpid/src/acpi/dmar/mod.rs` causes hangs on real hardware; entire DMAR path is commented out.
7. **DMI quirk matching is dead** — `redox-driver-sys/quirks/dmi.rs` reads `/scheme/acpi/dmi` but no code provides that scheme.
---
## Appendix A: Linux Reference File Map
From `local/reference/linux-7.1/`:
| Subsystem | Key Files |
|---|---|
| HID core | `drivers/hid/hid-core.c`, `hid-input.c`, `hid-quirks.c` |
| I2C-HID | `drivers/hid/i2c-hid/i2c-hid-core.c`, `i2c-hid-acpi.c` |
| USB HID | `drivers/hid/usbhid/hid-core.c`, `usbkbd.c`, `usbmouse.c` |
| Input core | `drivers/input/input.c`, `input-mt.c`, `evdev.c` |
| PS/2 | `drivers/input/serio/i8042.c`, `libps2.c`, `atkbd.c`, `psmouse-base.c` |
| I2C core | `drivers/i2c/i2c-core-acpi.c`, `i2c-core-base.c` |
| i915 | `drivers/gpu/drm/i915/` (6M+ lines) |
| ACPI | `drivers/acpi/` (full AML interpreter, 15k+ lines) |
## Appendix B: Uncommitted Changes (as of 2026-05-17)
The `bootprocess` branch has 63 changed files including:
- Kernel ACPI: `slit.rs`, `srat.rs` (NUMA), `msi.rs`, `vector.rs` (MSI/MSI-X), `sleep.rs` + `s3_wakeup.asm` (S3)
- Kernel: `numa.rs`, `mcs.rs` (MCS lock), context/percpu/event/sync improvements
- Base patches: `P4-acpi-estale-graceful.patch`, `P4-hwd-estale-graceful.patch`, `P4-ucsid-estale-graceful.patch`
- Kernel patch: `P21-x2apic-smp-fix.patch`
- Modified: pcid, driver-manager, thermald, redox-drm, redox-driver-acpi source files