5263150d3d
docs/plan/ldls.md. SchOS cannot write a driver for every device that exists
and no project can, so the only route to the hardware support an established
system has is to run Linux's. hybrid.md built the mechanisms for this and said
so; vgpud proved them. This is what they were for.
Five rules, and everything else is an implementation of them:
1. Nothing GPL ever enters an image we build. The driver is the user's,
obtained by them, loaded on their machine.
2. It runs in a process, never in the kernel. Legally a module linked into
our kernel is the strongest derivative-work argument that exists, and
practically this is foreign code that must not be able to take the
machine. FreeBSD has shipped from this position for a decade.
3. Facts, not expression. A symbol's signature and a struct's offsets are
facts a compiled driver depends on; comments, macro bodies and inline
bodies are expression and are never carried over. Provenance recorded per
file. Flagged in the doc as wanting real legal advice before shipping.
4. One kernel version at a time, pinned and named, because Linux says in
writing that it has no stable in-kernel ABI.
5. The unresolved-symbol list is the specification. Load a real module and
let the loader say what is missing rather than guessing the surface.
Four pieces: an ELF relocatable loader (ours, clean, no licence question), the
KPI shim (the actual work), /dev/pci as the back end (built), and one new
kernel interface -- a netdev whose backend is a process, which is the exact
analogue of display_ops and is four vtable entries wide.
First target is 8139too rather than r8169, and the reason is decisive: QEMU
emulates rtl8139 and does not emulate r8169, so the obvious choice cannot be
tested at all. 8139too is also smaller, needs no firmware, and uses the thin
mii helpers instead of dragging in phylib. r8169 is what proves it was general,
afterwards and much more cheaply.
The "what it will not do" section carries the honest list, including the two
that are not yet answered: no EXPORT_SYMBOL_GPL story, and no IOMMU -- which
for foreign drivers is a materially worse problem than for our own, and is the
strongest argument for one this project has produced.
hybrid.md is closed and leaves the register; ldls.md takes the slot, which is
the freeze rule working rather than being bent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
145 lines
6.7 KiB
Markdown
145 lines
6.7 KiB
Markdown
# What happens next
|
||
|
||
Everything in this directory is **unbuilt**. When a piece of it is finished it
|
||
leaves — deleted from here, rewritten as a description in
|
||
[../architecture/](../architecture/). See [the rule](../README.md#the-rule-that-keeps-this-from-rotting).
|
||
|
||
> ## Read [1.0.md](1.0.md) first.
|
||
>
|
||
> It draws a finish line and puts most of the work below on the far side of it.
|
||
> **Anything not named there is not being worked on**, and the documents in this
|
||
> directory describe more than 1.0 contains.
|
||
>
|
||
> It also holds **[the register of unfinished work](1.0.md#the-freeze-and-the-register-of-unfinished-work)**,
|
||
> which is the one place anything half-built is listed. No new capability starts
|
||
> until that register is empty, and a row leaves it only by being finished or by
|
||
> being deleted from the tree.
|
||
|
||
---
|
||
|
||
## The three current decisions
|
||
|
||
Taken together, because they turn out to need the same foundation.
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[wayland.md](wayland.md)** | The GUI stack becomes Wayland. SchWM and SchDE are **deleted** — actually gone from the tree, not marked; Schcom survives and changes its wire format. |
|
||
| ~~**hybrid.md**~~ | **Built.** All four mechanisms exist, the GPU driver runs outside the kernel, it survives being killed, and the display mode can be changed from a process. H4 (USB) was *withdrawn* rather than left open — USB is the bus peripherals arrive on, not a peripheral. |
|
||
| ~~init.md~~ | **Built.** PID 1 is now a role the kernel refills; the description moved to [../architecture/init.md](../architecture/init.md). |
|
||
|
||
And the one they all wait on:
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[foundations.md](foundations.md)** | Descriptor passing, shared memory, sockets in the filesystem. The critical path. **Item 1 is built** — `sendmsg`/`recvmsg` with `SCM_RIGHTS`. |
|
||
|
||
And the one that says which parts of the above are actually being worked on:
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[1.0.md](1.0.md)** | The finish line. Four gates, and everything else explicitly deferred. |
|
||
|
||
And the one the hybrid mechanisms were built for:
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[ldls.md](ldls.md)** | The Linux Driver Layer for SchOS. Someone else's drivers, in a process, reached through `/dev/pci` — because no project can write a driver for every device that exists. **Not started.** |
|
||
|
||
And one that is a tool rather than a capability:
|
||
|
||
| | |
|
||
|---|---|
|
||
| **[debugger.md](debugger.md)** | A debugger for this kernel — one that observes rather than halts, and answers in this kernel's own vocabulary. **Built**, except the network transport: symbols, a log that outlives the kernel, `/dev/dbg`, the `whose` ownership query and hardware watchpoints are all described in [../architecture/debugging.md](../architecture/debugging.md). |
|
||
|
||
Two longer-horizon documents sit behind these: [schapi.md](schapi.md), the API
|
||
layering and the compatibility promise, and [roadmap.md](roadmap.md), which holds
|
||
everything still open that is not one of the three above.
|
||
|
||
---
|
||
|
||
## The order
|
||
|
||
Set by [1.0.md](1.0.md), which is the authority. In short:
|
||
|
||
### 0. Fix what is already wrong — **first**
|
||
|
||
Not a document of its own; it is Gate 0 of [1.0.md](1.0.md), assembled from the
|
||
*What it does not do* sections in [../architecture/](../architecture/).
|
||
|
||
**Before any new capability**, and the reason is the one that put
|
||
`netdev_selftest()` before the TCP/IP stack: a compositor built on a kernel with
|
||
an unexplained hang and a socket layer that reports success for things it did not
|
||
do will fail in ways indistinguishable from its own bugs.
|
||
|
||
### 1. `foundations.md` — the critical path
|
||
|
||
Both the Wayland work and the hybrid work stop here. Descriptor passing and
|
||
shared memory are the substrate for handing a buffer to a compositor *and* for
|
||
handing a device to a driver process. **Doing it once for both is the entire
|
||
reason these are one plan rather than three.**
|
||
|
||
### 2. `init.md` — before the desktop, not after — **done**
|
||
|
||
A compositor being brought up for the first time crashes constantly, and
|
||
something that restarts it and says why is worth far more during that work than
|
||
at the end of it. Built; see [../architecture/init.md](../architecture/init.md).
|
||
|
||
### 3. `hybrid.md` — **moved up, and the reason is worth recording**
|
||
|
||
This document used to put the hybrid work *after 1.0*, deliberately last, on this
|
||
argument:
|
||
|
||
> designing a userspace driver interface with no driver consuming it produces an
|
||
> interface that is wrong in ways nobody can see
|
||
|
||
The argument was sound and the conclusion drawn from it was wrong. What forced
|
||
the change was the driver situation: SchOS cannot write a driver for every device
|
||
that exists, no project can, and the only route to the hardware support an
|
||
established OS has is a compatibility layer with the foreign drivers kept
|
||
*outside* the kernel. That layer is this plan's mechanisms. It is not optional and
|
||
it is not late work.
|
||
|
||
The original argument still holds, and it is answered rather than ignored:
|
||
**SchOS's own drivers are the consumers.** `vgpud` is a real driver, with real
|
||
requirements, and building the interface against it is what keeps it a general
|
||
mechanism rather than a hole shaped like something foreign. The compositor is
|
||
still a demanding consumer — it is no longer the *only* one available.
|
||
|
||
Four mechanisms, all built. One eviction done, the second withdrawn with its
|
||
reasons recorded, and the foreign driver host — [ldls.md](ldls.md) — is what
|
||
they were for.
|
||
|
||
### 4. `wayland.md` — with the GPU driver either side of the seam
|
||
|
||
W1–W3 and a terminal. W4 and W5 are post-1.0. Item 1 of `foundations.md` —
|
||
descriptor passing — was the thing it could not start without, and it now
|
||
exists.
|
||
|
||
---
|
||
|
||
## In one sentence
|
||
|
||
> Fix what is broken, build the descriptor-passing and shared-memory substrate,
|
||
> make init survivable, move the drivers out through an interface SchOS's own
|
||
> drivers have to live with first — and put a terminal on the screen.
|
||
|
||
---
|
||
|
||
## What this plan does not address
|
||
|
||
Stated here so it is not mistaken for covered:
|
||
|
||
- **No IOMMU**, so the hybrid work isolates against bugs and not against a
|
||
hostile driver.
|
||
- **No page cache**, so `foundations.md` delivers a `memfd` and not a general
|
||
answer to shared file mappings. The general answer is still owed.
|
||
- **No garbage collector for descriptors in flight**, so an `AF_UNIX` socket
|
||
passed over itself and never received leaks. Bounded at thirty-two sockets, and
|
||
nothing on this plan does it.
|
||
- **No dynamic linking**, so no Mesa, no accelerated clients, and no third party
|
||
shipping a `.so` for anything.
|
||
- **A new compatibility surface** between PID 1 and PID 2, created by a plan
|
||
whose own [schapi.md](schapi.md) §3 spends a section warning about those.
|
||
- **The three open networking items** — `getsockname`, routing, and
|
||
interrupt-driven receive — are untouched by any of this and still open. They
|
||
are in [roadmap.md](roadmap.md).
|