mirror of
https://github.com/vicliu624/trail-mate.git
synced 2026-11-11 14:47:39 +00:00
Trail Mate Dev
6e613e382e
Compose the CM0 fullscreen application and standard Debian package, align the Cardputer Zero shell, and share protocol, configuration, audio and storage services with embedded targets through existing platform seams. Add the paginated on-device TMAP creator using Center's published producer, private workspace recovery and direct keyboard shortcuts. Preserve unfinished management work behind its existing opt-in capability. Include native, ARM and shared-core regression fixtures, integration records, packaging helpers and dependency/license updates. Keep local build trees, device credentials, produced packages and validation logs outside version control. Validation before integration: ESP stack hygiene, Reticulum scope guard, staged whitespace checks and GitNexus scope audit. Prior device/build evidence and remaining hardware/package boundaries are recorded in the acceptance documents.
61 lines
3.6 KiB
Markdown
61 lines
3.6 KiB
Markdown
# Linux application restart and clock writes
|
|
|
|
The SDL desktop composition and the Cardputer Wayland/framebuffer entrypoints
|
|
now own an application lifecycle scope. A restart request is recorded atomically,
|
|
the rendering loop stops, and normal C++ scope cleanup releases UI objects and
|
|
application services. Only after the run scope has returned does the owner call
|
|
`execv` on the kernel's current executable identity. This replaces the process
|
|
image with the same executable and preserves its argument vector and environment;
|
|
it does not run a shell or reboot the operating system.
|
|
|
|
The former direct `exit(0)` path skipped automatic-object destruction and did not
|
|
restart the application. Compositions adopting the lifecycle now release phone,
|
|
radio, storage and presentation resources before replacement. Unadapted legacy
|
|
compositions retain their previous fallback behavior. A failed application run
|
|
is not restarted. A failed exec returns an error exit rather than pretending that
|
|
restart succeeded.
|
|
|
|
Window close, Alt+F4 and explicit automatic-exit deadlines take priority over an
|
|
overlapping restart request. A later restart request cannot reverse a recorded
|
|
normal exit. Repeated restart requests coalesce. There is no installed application
|
|
path or board identifier in the lifecycle owner.
|
|
|
|
After run-owned services shut down, the restart thread isolates its descriptor
|
|
table and marks residual non-stdio descriptors close-on-exec. This also covers
|
|
process-lifetime platform services and prevents other threads from racing a new
|
|
descriptor into the replacement image. The descriptor test includes an open
|
|
descriptor deliberately retained outside the run scope.
|
|
The descriptor-table operation uses the documented
|
|
[CLONE_FILES contract](https://man7.org/linux/man-pages/man2/unshare.2.html).
|
|
|
|
The process contract follows [execve(2)](https://man7.org/linux/man-pages/man2/execve.2.html).
|
|
The test launches a real child, checks cleanup of an intentionally non-CLOEXEC
|
|
descriptor before replacement, verifies destructor output and unchanged PID,
|
|
and confirms argument/environment preservation, including spaces and shell
|
|
metacharacters. It also covers an error result, exec failure and exit priority.
|
|
The phone facade regression calls the actual restart backend in a child and
|
|
requires a distinct continuation exit status, so the old `exit(0)` behavior
|
|
cannot produce a false passing result.
|
|
|
|
## Clock writes
|
|
|
|
The Linux `set_utc_time` port now calls `clock_settime(CLOCK_REALTIME)` and returns
|
|
the actual result. Negative timestamps are rejected before the syscall. It does
|
|
not substitute a local configuration value for an operating-system clock update.
|
|
The existing phone facade bounds its epoch conversion and propagates failure;
|
|
the shared phone protocols already map failed synchronization to failure replies.
|
|
|
|
System-clock authorization is an operating-system deployment prerequisite. This
|
|
change does not grant capabilities to the executable or install an elevated
|
|
helper. The normal unprivileged application's clock-write capability is therefore
|
|
not established by these tests, and full phone time administration remains subject
|
|
to deployment policy. NTP and timezone policy are unchanged.
|
|
See the Linux [clock interface](https://man7.org/linux/man-pages/man3/clock_gettime.3.html)
|
|
for the operating-system privilege requirement.
|
|
|
|
Clock tests interpose the syscall inside the test process. They verify the target
|
|
clock, timestamp, success, permission rejection and invalid-value rejection without
|
|
changing any host or device clock. The shared Meshtastic protocol regression also
|
|
verifies that the actual Linux facade returns rejected writes as failure and
|
|
successful writes as success.
|