# nt-lite — remaining roadmap **Status:** lean-boot and cleanup work completed; Phase 2 remains open; Phase 3 startup work implemented, with service administration and release validation remaining. **Scope:** Linux-derived USB/SCSI/HID/input replacement, final native service control, then deferred filesystem, security, POSIX, desktop, loader, debugging, graphics and driver compatibility work. ## Completed foundation (brief) - **Boot and build:** lean boot with gated checks, timestamped diagnostics, opt-in tests, historical BUILD.EXE integration, and VHD packaging. Six correctness, structure, configuration, logging and test-pruning passes completed. - **Drivers:** dynamic PnP registrations, two-phase load/start and rollback, exact/class dependency settlement, bounded parallel driver startup and kernel-thread exit synchronization. Keep module readiness distinct from PnP device readiness. - **Services:** strict `services.ini` with `[session]`, `auto|delayed|disabled`, `requires`/`after`, concurrent READY settlement, retry budgets for launch/READY/exit failures, named privileges, capability grants, and generic RSSRV bootstrap authority. Automatic services settle before the shell; delayed services follow it. - **Existing subsystems:** POSIX P0–P7, native UABI.1–UABI.4, native surfaces/DWM, and driver/device shutdown contracts. ## Hardware still needing work - **Desktop AMD:** xHCI `1022:43d5`/`1022:149c`, especially with both external hubs attached. - **ThinkPad T14 Gen 5 AMD:** xHCI `1022:15b9/15ba/15c0/15c1`, hub/control timeouts, internal i8042 keyboard/TrackPoint, `ELAN0676` over `AMDI0010:01`, Unifying `046d:c52b`, and AML power-button handling. The direct `09da:2268` boot keyboard has worked in prior tests. ## Operating decisions 1. One owner and one native interface per concern. Delete obsolete callers and compatibility paths during API changes. 2. Regression and stress tests are opt-in; production boot retains necessary runtime failure checks. 3. Use monotonic `DbgPrint` timestamps to measure actual stalls. Preserve concurrent, logical-line-safe output. 4. Prefer Linux-derived standard hardware state machines to vendor-specific shortcuts; retain provenance and applicable licensing obligations. 5. Keep the driver graph distinct from runtime PnP: `requires` waits for success, `after` for settlement; shutdown reverses dependencies. 6. RSSRV is an ordinary critical service with explicitly delegated bootstrap authority, independent of its image or ID. Ambient privileges and capability handles are separate; SASOS implies limited isolation. 7. Keep instrumentation and tests only where they protect important behavioral contracts. --- # Active work ## Phase 2 — Linux-derived USB, SCSI, block, HID and input replacement **Status:** architecture approved in principle; source import, compatibility runtime, new module graph, and hardware validation remain open. Existing `usb.sys` is a diagnostic baseline, **not** the implementation to extend feature by feature. The code already booted with direct USB storage and boot keyboards on some runs, but desktop hub hangs, ThinkPad full-/low-speed control timeouts, hub-child enumeration, generic HID coverage, and built-in input remain unresolved. Earlier patch application and syntax checks do not establish hardware fixes. **Implementation rule:** prefer a pinned, upstream Linux implementation for USB, xHCI, HID, input, SCSI and its necessary block support. Port closely where possible, adapt through private runtime/platform layers where needed, and rewrite the *smallest problematic dependency or native boundary* against Linux's semantics if a direct port costs more than a tested native implementation. Preserve provenance, specification-level behavior and the relevant licensing obligations in all cases. Avoid keeping a parallel bespoke USB core or two owners of USB device state. **P2.0 — Source freeze, dependency closure and legal provenance.** Pin an exact upstream Linux revision and imported-file hash manifest; derive the selected sources and transitive symbols using upstream Kconfig, Makefiles and actual code, across `drivers/usb/core`, `drivers/usb/host/xhci*`, `drivers/usb/storage`, `drivers/hid`, `drivers/hid/usbhid`, `drivers/input`, `drivers/scsi` and the required `block/` support. Exclude USB gadget, unrelated HCDs and class drivers until demanded by a real feature. Stage third-party notices, original per-file SPDX/copyright, GPLv2 text, modifications, complete corresponding-source/build-script distribution procedures; a notice alone does not discharge all license obligations. Record a port/adapt/rewrite decision per component based on dependency cost and testable semantics. Maintain the last bootable source as a regression baseline, not an ongoing duplicate stack. **P2.1 — Compiler and module ABI feasibility gate.** Build, link and execute representative upstream units from xHCI, USB core, HID/input and SCSI/block. Explicitly audit MSVC x64's LLP64 model and Microsoft calling convention versus Linux x86-64 LP64 and System V; audit layout, atomics, bitmaps, pointer-sized fields, inline asm, object relocation and compiler builtins. Compare native PE/COFF with a contained alternative internal Linux ABI/module format. Choose by measured total integration and maintenance cost; retain nt-lite's kernel/public ABI at the external boundary. A successful syntax-only build cannot close this gate. **P2.2 — Shared Linux compatibility runtime.** Supply exactly the used allocator/page, coherent and streaming DMA, SG, atomic/refcount, spinlock/IRQ masking, mutex/completion/wait, worker/workqueue, delayed work, timer, device/refcount and driver-binding, PCI/IRQ/MMIO, clock, error and logging contracts. Their cancellation, concurrency, memory-order and sleepability semantics must match the imported components. Avoid a second general native device manager: native PnP owns PCI discovery; Linux's device graph owns imported USB/HID/SCSI children. Test allocation failures, work cancellation, timer teardown, interrupt/thread context, DMA rundown and exactly-once callbacks independently before relying on the runtime. **P2.3 — External object/authority boundary.** Native PnP initiates physical xHCI controller binding; the imported USB graph owns root hubs, downstream devices, interfaces, endpoints and URBs. Translate only at deliberately narrow native publication boundaries: Linux input event -> native KeInput/RSSRV and Linux SCSI disk -> native `DEVICE_OBJECT`/disk I/O. Keep Linux URB/HID/SCSI/block structures private. Derive errors and rights explicitly; assign references on both sides; stop publication and new I/O before draining callbacks on removal. Avoid native filesystem dependencies on Linux `bio`, `gendisk`, or SCSI command internals. **P2.4 — Native disk substrate prerequisite.** Remove the eight-disk registry limit and `uint8_t` identity constraint; adopt reusable generation-safe device identities. Publish logical/physical sector geometry, capacity, alignment, flush/removal and transfer limits. Remove 512-byte assumptions from disk I/O and GPT/MBR discovery; verify native AHCI/ATA remains functional. Test 512/4096-byte devices, partitions, disappearing devices, simultaneous operations and stable system-volume selection. **P2.5 — Linux USB core and xHCI together.** Retain upstream HCD/URB, command and transfer ring bookkeeping, TD completion matching, endpoint state transitions, cancellation, command timeout/recovery, protocol-based USB2/USB3 root hubs, external hubs, hub routing and TTs, composite/alternate configurations, interrupt/bulk/control/isoc and streams where enabled. Integrate native PCI, DMA, MSI/IRQ and module lifecycle beneath the Linux USB model. Avoid placing the old nt-lite URB model between Linux USB and Linux xHCI. Begin with QEMU controllers and hub topology, then enumerate/transfer/fail/recover on both AMD machines. Use traced TRB/completion and device path evidence rather than timing workarounds. **P2.6 — Linux SCSI and block.** Port the SCSI host/device/LUN midlayer, command lifecycle, sense/error/timeout recovery, SCSI disk upper layer (`sd`) and required blk-mq/request infrastructure. Prefer upstream block privately inside the imported storage stack. If blk-mq imports disproportionate unrelated kernel machinery, rewrite only the block-facing queue adapter while preserving SCSI ordering, asynchronous completion, timeout and recovery guarantees. Validate first with a synthetic SCSI host: INQUIRY, TEST UNIT READY, READ CAPACITY, READ/WRITE, SYNCHRONIZE CACHE, multi-LUN, injected errors and hot-remove. Publish a disk through the native adapter only after this path works end to end. **P2.7 — USB-storage and UAS.** Import the Linux Bulk-Only Transport drivers, transport helpers, device quirks and UAS where stream/queue semantics are ready. Feed Linux SCSI rather than a parallel native command implementation. Test direct and hub-attached media; multiple disks/LUNs; read/write/flush; disconnect while busy; reconnect; reset; shutdown. Boot-critical SCSI, USB and host-controller modules must be available from EFI/bootstrap media before the configured system volume is mounted. **P2.8 — Linux HID and input.** Port the HID core and generic report parser, `usbhid`, necessary input event core and required key/mouse/multitouch mappings. Decode real report descriptors and composite interfaces rather than relying solely on boot protocol or QEMU device shortcuts. Map Linux input codes to nt-lite's native usage/event representations at one boundary; retain RSSRV's focus/capture/session and typematic policy. Support LEDs/output reports, mouse motion/buttons/wheel, disconnect release of pressed state and multi-device use. The secondary interface of a working USB keyboard must have an explicit supported or correctly scoped outcome, without making the functioning boot interface fail. **P2.9 — Physical input follow-on.** Evaluate importing `i8042`, `serio`, `atkbd` and `psmouse` for the ThinkPad's internal keyboard and TrackPoint; rewrite only a narrow host/interrupt adaptation when useful. Evaluate Linux I²C host/core, `i2c-hid` and HID multitouch for `AMDI0010:01` / `ELAN0676`; use ACPI-described resources and interrupt/power methods. These devices feed the *same* canonical input path. Retain the ACPI `PNP0C0C`/AML power-button gap as independent platform work; consider ACPICA before authoring a new AML engine. No xHCI patch can fix that firmware-control path. **P2.10 — Module graph, builds and distribution.** Provide real dynamic ownership boundaries: internal Linux runtime, USB core/HCD, xHCI, HID, input, SCSI/required block support, `usbhid`, USB-storage/UAS. Combine units when upstream ownership and linkage make a separate DLL artificial; do not force module count for its own sake. Update imports/exports, driver `requires`/`after`, source builds, packaging, runtime discovery, bootstrap preload, shutdown and unload rundown together. Linux device enumeration is an asynchronous runtime event, distinct from driver `DriverEntry` readiness. No hidden dependency cycle through the USB boot volume. **P2.11 — Verification and deliberate cutover.** Require synthetic concurrency tests, QEMU enumeration/hub/transfer tests, hardware tests on the desktop `03:00.0` (`1022:43d5`) and `28:00.3` (`1022:149c`), and all four ThinkPad xHCI functions (`1022:15b9/15ba/15c0/15c1`). Validate physical/USB2/USB3 mapping, mixed-speed hubs, the desktop's two hubs with wired keyboard, Logitech receiver, Bluetooth dongle and storage, and ThinkPad direct/hub-connected input/storage. Stress concurrent URBs, timeout, endpoint reset, hotplug, I/O cancellation, sleepable/IRQ context and shutdown. Measure throughput and tail latency rather than presuming an upstream port will automatically be faster. Delete bespoke USB enumeration, controller, HID and storage code and stale APIs after the Linux-derived path passes acceptance. Retain no permanent shadow enumeration path. **P2.12 — Upstream maintenance.** Record original source hashes, local adaptation patches, component decisions, test ownership and imported licenses. Track security fixes, protocol fixes and AMD controller quirks against the pinned release; review dependency changes when updating. Keep the imported source materially recognizable to upstream wherever possible. **Phase 2 acceptance:** QEMU boots and enumerates keyboard/tablet/storage; both real machines boot reliably with the previously failing hub topologies; direct and behind-hub control/bulk/interrupt transfers work; generic HID/Unifying input reaches RSSRV; storage survives multiple LUNs and abort/reconnect tests; native disk geometry/partition discovery is correct; shutdown/reboot drain owned DMA and callbacks. ThinkPad PS/2/TrackPoint, I²C touchpad and AML power button retain their separately tracked hardware/platform gates. A release with only syntax checks, successful module loading or direct-device enumeration leaves this phase open. ## Phase 3 — Parallel graph startup and native service management **Status:** startup implementation in place; service administration and integrated validation remain before the nightly. **Implemented:** four-worker driver graph, dependency settlement and worker-exit synchronization; concurrent `auto` services, post-session `delayed` services, `requires`/`after`, READY/failure handling, per-service fixed-delay restart budgets, `[session]` shell selection, named privileges and scoped capability grants, and configuration-selected RSSRV bootstrap authority. **Finish for nightly:** - Add an **init-owned service control interface** through existing IPC/security primitives: query status and failure/wait reason; authorized start, stop and restart; expose restart counters. Enforce critical-service protection, `requires` dependencies, and reverse-order shutdown. - Validate QEMU with one and four CPUs and an SMP hardware boot. Exercise worker idle wakes/joins, dependency success/failure/settlement, READY timeout, startup failure and restart exhaustion, delayed-service ordering, and RSSRV least-privilege authorization. Remove temporary diagnostics afterward. **Deferred:** service `start=demand`, resource/connection-triggered activation and deduplication, reconfiguration, and advanced restart backoff belong to D6. Keep startup policy `auto|delayed|disabled` for this release. **Done when:** management authorization and lifecycle regressions pass, services reach the shell reliably, and driver workers exit cleanly on the tested SMP configurations. --- # Deferred work These are **still outstanding**. The previous roadmap's detailed designs should not be mistaken for implemented behavior. Resume in dependency order, not by the age of its section numbers. ## D1 — Native filesystem substrate: KFS.1–KFS.7 Do this before POSIX P8 and before attaching durable ACL identity. - **KFS.1:** refcounted native file-backing identity separate from each `FILE_OBJECT`/open description; key by mounted volume + stable provider file ID + generation where available; coherent shared file size/page cache/mapping/security across aliases/opens. - **KFS.2:** unlink removes a directory link while live open/mapping references retain backing until final release. - **KFS.3:** genuine capability-relative hard links, stable link counts; native cross-volume status; NTFS/ext4 providers where supported; FAT may report unsupported. - **KFS.4:** atomic rename replacement where supported and canonical cross-volume failures. - **KFS.5:** generic metadata setter and UTC persistent timestamps, without repurposing system-clock/provenance structures. - **KFS.6:** native directory enumeration reset/restart without pathname reopen. - **KFS.7:** focused provider/runtime validation of independent opens, aliases, mmap/page-cache coherence, unlink lifetime, hard links, replacement, timestamps and directory iteration. ## D2 — Native security: SEC.0–SEC.15 Native authorization remains **capability-first**. Keep userspace account identities separate from kernel principals; do not claim full inter-process memory protection under shared-PML4 SASOS. - SEC0/1: threat boundary and rights taxonomy; stable opaque principal IDs and immutable/materialized security contexts with groups, privileges, restrictions and audit identity. - SEC2/3/4: one native security descriptor with owner, owning group, allow/deny ACL, creation templates; matching denies win independent of ACE order; authorize capability acquisition through the object manager. Ownership grants authority to mutate security policy, not implicit read/write of data. - SEC5–9: provider contract, ext4/NTFS translation, creation-time inheritance, owner/security mutation; metadata lives with coherent file backing. Existing granted capabilities survive ACL changes unless explicitly revoked. - SEC10/11: separate named privileges and derived restricted contexts; don't introduce Unix root as a kernel special case. - SEC12/13: user-mode accounts/authentication/password storage and kernel-stamped audit with userspace persistence/filtering. - SEC14/15: process/device/IPC/service authorization sweep and POSIX/Win32 personality mapping. Phase 3's service-specific privilege/capability grants must be designed to extend naturally into SEC rather than build a second authorization regime. ## D3 — Finish POSIX personality: P8–P10 **P0–P7 complete**; preserve the existing `posixsrv`-owned stable PID, non-fork `execve`, `vfork`, spawn/wait and signals design. `fork()` stays deliberately unsupported; do not add Unix kernel process semantics. - **P8 (after KFS/SEC):** project native principal/ACL ownership and permissions into POSIX uid/gid/mode, `chmod/chown/access`; preserve `umask` as creation-time restriction; native hard-link/rename/timestamp/directory-reset APIs; FIFO namespace and rendezvous policy in `posixsrv` with native pipe data transport; correct errno and path/directory APIs. - **P9:** POSIX tty/termios as userspace adapter over RSSRV console/session, canonical/raw input, echo, drain/flow, VMIN/VTIME, controlling tty and foreground process-group signaling (`VINTR`/`VQUIT`). - **P10:** remaining leaf/profile APIs (`uname`, `times`, `sysconf`, `pathconf/fpathconf`, etc.), canonical status mappings, header/export/profile audit, removal of obsolete helpers. Validate the end-to-end spawn/pipe/signal/wait/exec scenario and deliberately unsupported operations. ## D4 — Native desktop/session completion - Represent the RSSRV-owned console as a DWM-managed surface/window. RSSRV keeps console state and session input authority; DWM owns graphical geometry, clipping, composition and physical presentation. - Add native decorations, close lifecycle, move/resize, title/app identity, pointer capture, activation/focus/z-order rules, minimize/maximize policy, damage rectangles, occlusion and incremental composition; keep the CPU compositor as reference. - Shell (taskbar/launcher/notifications/work area) is **not** DWM policy. Use explicit capabilities for privileged window enumeration/capture/input injection/secure surfaces and display control. - Delete legacy application direct input/console/display APIs after the canonical RSSRV/DWM route is complete; choose an explicit DWM crash/restart model (reconstruct state or invalidate/reconnect clients). Native UI toolkit/theme can follow. ## D5 — Loader, native runtime, and personalities - Finish cross-personality `KSTATUS` to POSIX errno / Win32 LastError mapping; keep one mapping owner per personality. - Identify loaded modules by resolved backing-file/object identity, with aliases and import/reference ownership; prerequisite to reliable kernel module unload and CRT aliases. - Use PE32+ subsystem to select native (1), Win32 GUI/CUI (2/3), or POSIX marker (7). Win32 userspace bootstrap creates its PEB/TEB shim and uses generic persistent per-thread FS/GS bases; native and POSIX remain on their existing TEB layout. Do not introduce personality-specific kernel scheduler state. - Split `crt.dll`, `posix.dll`, and Win32-facing libraries along true ownership boundaries; add thin USER/GDI translation to native DWM/surfaces only when the native desktop is mature. ## D6 — On-demand lifecycle, observability, and cleanup - Service demand and resource/connection activation: `start=demand`, authorized requests, deduplicated triggers, optional service reconfiguration and advanced restart backoff. Keep one init-owned control plane. - Complete module import/reference accounting and PnP-owned device/worker/DPC/IRP/IRQ/DMA quiescence before any actual unload; then exact-driver reload and optional cascade reload over the same graph. - Add `start=demand` for drivers, activated by PnP IDs, authorized management requests, or dependency demand, not by a parallel private graph. - Structured native read-only driver/class status and wait/failure causes; no requirement to scrape `DbgPrint` for management. - Complete justified driver decomposition (upstream-derived USB submodules, NTFS glue, VMware SVGA hardware vs generic raster), remaining input typematic cleanup, and future power/hotplug lifecycle testing. ## D7 — Debugger and compatibility/graphics research These are intentionally **not prerequisites** for boot, service cleanup, KFS, or POSIX completion. - **Minimal serial KD:** debugger-owned polling UART independent of normal serial driver; KD packet/ACK/resend, context/memory/breakpoint/single-step, panic/break-in, SMP stop/release, minimal module/PDB metadata, first verified against WinDbg/QEMU. No need for KDNET initially. - **Native 2D/text and graphics split:** mapped kernel surfaces remain canonical. Userspace 2D and Unicode font/shaping/raster layers, software reference raster; hardware miniports own modes, VRAM, scanout, DMA/fences; optional validated batched acceleration stays behind generic graphics abstractions. - **USER/GDI and X11:** future Win32 USER/GDI wrappers map to native DWM/RSSRV/surfaces; `x11srv` is a userspace X protocol server (nested and rootless modes) with native capture/focus authority preserved. Neither redefines kernel surfaces. - **Networking and compatibility drivers:** neutral native `NET_DEVICE`/packet contract; eventual protocol stack in userspace where practical; NDIS 6 **Ethernet miniport** experiment only after native mechanics stabilize; proprietary/vendor Wi-Fi work preferably as clean native hardware/firmware ports with userspace `wifisrv`. A future NVIDIA/GSP/Mesa/NVK experiment must consume nt-lite GPU APIs rather than impose Linux DRM as the native ABI. --- # Verification and handoff rules - **Boot:** record source revision/patch set, machine, firmware, debug mask, test-packaging mode, wall-clock start/end definition, and timestamped kernel log. Keep cold/warm comparisons distinct. Track reproducible cold/warm boot intervals and the actual build flags. - **Hardware:** validate each controller/port/hub/interface separately and capture the first failing stage. For imported USB/xHCI/SCSI/HID ensure timeout, disconnect, cancellation, DPC, I/O, remove, shutdown and reboot ownership. Include both desktop external hubs and ThinkPad `046d:c52b`/`09da:2268`, plus USB storage directly and behind hubs. - **Concurrency:** stress dependency cycles/failure/settlement, deterministic selection, ready-event races, worker idle wakeups and completion joins, service restart budgets, cancellation and reverse shutdown—not only a clean boot. Do not restore mandatory stress tests to the boot path. - **Services/security:** prove a minimally privileged database-like service cannot obtain RSSRV namespace management, display, input, raw storage or shutdown capabilities; explicit granted handles work; only authorized callers can control services. - **KFS/SEC/POSIX:** preserve file/provider identity across rename/unlink and native capability rights; run the focused filesystem, security and POSIX integration suite in development builds. - **Code baseline:** use a newly provided current source tree when starting implementation. Earlier chat archives, `code(5).zip`, and prior cumulative patches may not represent the user's latest checkout. Never call a patch 'built' when only `git apply --check`, a syntax check, or a standalone model has passed.