| Filename | Latest commit message | Latest commit date |
|---|---|---|
3034efd300
The network thread waited on the timer and nothing else, so a frame that landed just after a poll sat in the ring for up to 10 ms -- the largest fixed latency in the system. That was deliberate when the stack was new (a receive path woken by an interrupt is much harder to debug than one that is asked) and there is now a working stack to compare against, which is exactly when it becomes safe to do. The frame is still *pulled* by the thread through .receive. It has to be: a call into lwIP can reach the driver, the driver can sleep on the buffer cache, and an interrupt handler may do neither. netdev_rx_signal() delivers nothing and reads no ring -- it only ends the wait early. The wait stays on the timer tick rather than moving to a channel of its own, and that is the design. lwIP's timers must still run when the link is silent, so the clock has to remain a floor under the wait, and sleep() cannot wait on two things at once. Joining the tick's existing wakeup costs nothing and leaves one wait with one predicate. rx_signal lives under tickslock for the same reason it gets no lock of its own: sleep() releases tickslock atomically, so a driver setting the flag and waking under that lock cannot lose the wakeup by arriving between the predicate test and the sleep. A private lock would not be held across the sleep, and that window would be back. Calling it from interrupt context is safe on the same terms the timer handler already relies on -- acquire() disables interrupts, so a CPU holding tickslock cannot be interrupted into it. The e1000 signals on RXT0 (a frame or burst has landed) and RXDMT0 (the ring has fallen below its threshold, which is when waiting for the clock hurts most). Measured rather than asserted: /proc/netif reports wake_rx and wake_tick, and across three pings rx_frames and wake_rx both went 2 -> 6 -- every received frame woke the thread through the interrupt. wake_tick keeps advancing as the idle floor, which is what lwIP's timers need. socktest still passes and ping is still 0% loss. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2 |
||
| .. | ||
| 1.0.md | ||
| foundations.md | ||
| hybrid.md | ||
| init.md | ||
| README.md | ||
| roadmap.md | ||
| schapi.md | ||
| wayland.md | ||
What happens next
Everything in this directory is unbuilt. When a piece of it is finished it leaves — deleted from here, rewritten as a description in ../architecture/. See the rule.
Read 1.0.md first.
It draws a finish line and puts most of the work below on the far side of it. Anything not named there is not being worked on, and the documents in this directory describe more than 1.0 contains.
The three current decisions
Taken together, because they turn out to need the same foundation.
| wayland.md | The GUI stack becomes Wayland. SchWM and SchDE are deleted; Schcom survives and changes its wire format. |
| hybrid.md | The kernel becomes hybrid — drivers move out into userspace processes, starting with the GPU. |
| init.md | PID 1 stops being a process and becomes a role the kernel guarantees is filled. |
And the one they all wait on:
| foundations.md | Descriptor passing, shared memory, sockets in the filesystem. The critical path. |
And the one that says which parts of the above are actually being worked on:
| 1.0.md | The finish line. Four gates, and everything else explicitly deferred. |
Two longer-horizon documents sit behind these: schapi.md, the API layering and the compatibility promise, and roadmap.md, which holds everything still open that is not one of the three above.
The order
Set by 1.0.md, which is the authority. In short:
0. Fix what is already wrong — first
Not a document of its own; it is Gate 0 of 1.0.md, assembled from the What it does not do sections in ../architecture/.
Before any new capability, and the reason is the one that put
netdev_selftest() before the TCP/IP stack: a compositor built on a kernel with
an unexplained hang and a socket layer that reports success for things it did not
do will fail in ways indistinguishable from its own bugs.
1. foundations.md — the critical path
Both the Wayland work and the hybrid work stop here. Descriptor passing and shared memory are the substrate for handing a buffer to a compositor and for handing a device to a driver process. Doing it once for both is the entire reason these are one plan rather than three.
2. init.md — before the desktop, not after
A compositor being brought up for the first time crashes constantly, and something that restarts it and says why is worth far more during that work than at the end of it.
3. wayland.md — with the GPU driver still in the kernel
W1–W3 and a terminal. W4 and W5 are post-1.0.
4. hybrid.md — after 1.0
Deliberately last: designing a userspace driver interface with no driver consuming it produces an interface that is wrong in ways nobody can see. The compositor is the demanding consumer that makes the interface judgeable, so it has to exist first.
In one sentence
Fix what is broken, build the descriptor-passing and shared-memory substrate, make init survivable, put a terminal on the screen — and only then use the compositor as the pressure that shapes the userspace driver interface.
What this plan does not address
Stated here so it is not mistaken for covered:
- No IOMMU, so the hybrid work isolates against bugs and not against a hostile driver.
- No page cache, so
foundations.mddelivers amemfdand not a general answer to shared file mappings. The general answer is still owed. - No dynamic linking, so no Mesa, no accelerated clients, and no third party
shipping a
.sofor anything. - A new compatibility surface between PID 1 and PID 2, created by a plan whose own schapi.md §3 spends a section warning about those.
- The three open networking items —
getsockname, routing, and interrupt-driven receive — are untouched by any of this and still open. They are in roadmap.md.