SRDX — sigilOS Remote Desktop Exchange
SRDX is not RDP. It is not VNC. It is a capability-secured, GPU-delta remote desktop protocol built into the sigilOS kernel — where the display path is a held capability, not a privilege.
1. What SRDX is (and what it isn't)
RDP and VNC are network protocols bolted onto operating systems that were designed without them. Any process with the right network socket can start an RDP server. SRDX is different: the capability to display remotely (CAP_DISPLAY_REMOTE) is a held kernel capability, granted explicitly at session creation. No process can remote-display without holding it. The kernel mediates every frame.
fbtap.sg → srdx_encode → srdx_wire → remote. All four steps are inside the trusted computing base.CAP_DISPLAY_REMOTE. Receiving input from a remote client requires CAP_INPUT_REMOTE. Neither is ambient.2. The proof chain — 0.6.0
All five proofs passed on x86 QEMU. The chain is end-to-end: tile encoder → delta decoder → local loopback → TCP wire → raw-NIC fragments → full network round-trip.
| Proof | Commit | What it proves |
|---|---|---|
| SRDX-ENCODE-PASS | 8f9de77 (sigil-video) |
Tile-based dirty-rect delta encoder; unchanged tiles = 0 bytes |
| SRDX-DECODE-PASS | b10fea5 (sigil-video) |
Client-side delta applier; GPU_FIRST dispatch table |
| SRDX-LOOPBACK-PASS | 1ae6584 (sigil-video) |
Local round-trip: fbtap→encode→decode→present, pixel-verified |
| SRDX-WIRE-PASS | 12e99d5 (sigil-video) |
TCP transport wrappers + wire loopback; HELLO/SCENE/INPUT framing |
| SRDX-RAW-PASS | 487d00a (sigil-video) |
Raw-NIC transport: 11 ×≤1,506 B fragments, 8 B header each, reassemble+verify |
| SRDX-NET-RT-PASS | 905c968 (sigil-video) |
Full network round-trip: fbtap_init(64,64) → two-tone fill → encode (1 tile, 16,448 B) → fragment → raw-NIC loopback → reassemble → decode → VESA 0x500000 → pixel verify row16=blue/row48=red. 5/5 PASS. |
3. Two transport paths — one negotiation ABI
srdx_wire.sg presents a single srdx_wire_send/recv surface regardless of which transport is active. The caller never branches on transport type; negotiation happens once at session open.
sys 109–112
net_conn_listen / net_conn_send / net_conn_recv / net_conn_close. Primary transport for LAN/WAN sessions. Full TCP reliability and flow control. SRDX-WIRE-PASS.sys 113–116
srdx_raw_send / srdx_raw_recv / srdx_raw_link / srdx_raw_mac. Bypasses the network stack — sends raw Ethernet frames directly via nic_send_raw. Lower latency for same-subnet sessions (no TCP header overhead). Frame max 1,506 B; larger payloads fragment automatically. SRDX-RAW-PASS.4. The syscall surface (sys 109–116)
| Syscall | Name | Description |
|---|---|---|
| 109 | net_conn_listen(port) | Open TCP listener on port. Returns conn handle. |
| 110 | net_conn_send(conn, buf, len) | Send len bytes from buf on conn. |
| 111 | net_conn_recv(conn, buf, max) | Receive up to max bytes into buf. Blocks until data or close. |
| 112 | net_conn_close(conn) | Close connection and free handle. |
| 113 | srdx_raw_send(iface, buf, len) | Send raw Ethernet frame (≤1,506 B) on iface. |
| 114 | srdx_raw_recv(iface, buf, max) | Receive raw Ethernet frame. Blocks or polls. |
| 115 | srdx_raw_link(iface) | Check link state on iface. Returns 1=up, 0=down. |
| 116 | srdx_raw_mac(iface, out) | Read MAC address of iface into 6-byte out. |
5. Mode-1 and Mode-2
Mode-1 — pixel stream
The host runs the application normally. fbtap.sg taps the framebuffer region, srdx_encode computes the dirty-tile delta, and the delta is sent via srdx_wire. The remote renders the delta into its local framebuffer via srdx_decode. Input from the remote is sent back via SRDX INPUT messages and injected by the host kernel.
Standard screen-sharing: zero modifications to the hosted app. The app does not know it is being remoted.
Mode-2 — rollback netplay
Both endpoints run independent instances of the same deterministic application (e.g., a RetroPie core). The ACPI PM timer (3.579545 MHz, 279 ns resolution) provides the rollback clock. When a late input arrives from the remote, both sides call core_loadstate(snap_slot) to the last agreed frame and replay with corrected inputs.
The rollback window is typically 4–8 frames (≈67–133 ms at 60 fps). The snap() / rest() ABI is implemented for all 73 RetroPie cores, making Mode-2 available across 41 years of gaming.
Mode-2 requires: savestate ABI on both sides + ACPI PM timer for clock sync + SRDX connection log for session state.
6. Viewer and Session Manager
viewer.sg (864df81, sigil-apps): SRDX remote desktop viewer in the Lumen WM. Chips: STATE (connecting/active/paused), FPS (live frame rate), BUF (buffer depth). srdx_negotiate_viewer() auto-negotiates transport. Canvas placeholder for decoded frames. Shows in the REMOTE DISPLAY Smart Folder.
sessions.sg: Session Manager with REMOTE DISPLAY folder. Lists active SRDX sessions from the connection log (srdx_persist_log_join / log_leave / log_count). Double-click opens viewer.sg for that session.
SRDX connection log: 8-byte append-only entries (4B seq from file size + 1B event + 1B sess_id + 2B port). Crash-safe — no WAL, no partial writes.
7. SRDX bench
902e9be (sigil-video). SRDXBENCH-PASS on a 160×120 px frame with 32×32 tile size:
ntiles — tile countfull — full-frame encodefrags — raw-NIC fragmentsfps — theoretical throughputdelta — re-encode unchanged frame
8. The 2→16 node mesh
SRDX is designed for N-node sessions, not just 1:1. The session model: one host, up to 15 remotes. Each remote holds a viewer session; the host multiplexes the encoded stream.
Mesh sessions are planned for 0.7.x once the two-Pi 1:1 end-to-end is proven on real hardware. The 0.6.0 milestone (SRDX-NET-RT-PASS on x86 QEMU) is the prerequisite: one node proven end-to-end is the foundation for N.
9. Security model
The SRDX security model is not an add-on. xport_uptr_ok(ptr, len) and xport_outbuf_ok(ptr) guard every EL0→EL1 SRDX frame boundary:
- Null pointer — rejected before any dereference
- Negative length — rejected at the sign check
- MTU overrun (>1,514 B) — rejected before any copy
- Integer wrap — rejected by overflow-safe arithmetic
PASS SRT bnd=1 (f701583, sigil-kernel). No EL0 process can use a crafted SRDX message to read or write kernel memory.
The capability gates apply at the session layer — before any frame is decoded or displayed. A process that does not hold CAP_DISPLAY_REMOTE cannot open an SRDX host session. A process that does not hold CAP_INPUT_REMOTE cannot inject input from a remote source. These are not checks; they are the absence of a path.