Hi,

Good to hear that you are also going to do this! For us, there is a
clear need for a GUI system that is both dynamic and simple in use.

This is actually very similar to what the existing menu_view already
gives you.

This configurablility would indeed be similar to menu_view.
Another main difference is that it does not aim to replace menu_view,
but is an overlapping component that could also handle input, and take
actions, such as collapsing and expanding submenus. It could still use
menu_view, fading_dialog and such parts. So instead it aims to replace
the menu part of launcher, except that it is dynamic and generic.
What we would like is such a menu component that could be used at many
places; not only for a desktop environment, but also inside any
application, or settings menu, or subsystem.

It would be complete with elements such as buttons, submenus and
dialogs, and the notion of clicking on these elements. These events
could somehow be communicated to other elements such that the
corresponding actions are taken.

I'd advise not to use the report/ROM interface to propagate events, but
only state. Even though one (myself included) is sometimes intuitively
tempted to mix up events and states, it calls for trouble.
[...]

Makes sense, you are right. However, for clicking buttons in this context, it makes sense to communicate events instead of states. Perhaps using another way than reports could be useful here, such as some list of events like in Input, or a packet-stream like functionality.

This raises the question of where does the responsibility of the menu
end, and where do the responsibilities of the subsystem manager start?
If we need a subsystem manager anyway, couldn't it use the menu_view(s)
directly to implement menus?

We would like to separate the menu with all its buttons from the subsystem state logic.

Whenever we want an application that uses the GUI that does different
things, we would have to import the menu management
code into these applications. This could be done as a library with
functions for creating buttons and menus, or as a separate component
that can be configured and uses some IPC mechanism. In the latter case,
more than one component can talk with the same menu, depending on the
application programmer's needs.
This can be made as complex or simple as is desirable. However now it is
already quite complicated to create only a basic menu as all the
features are very intertwined, which makes the code a bit hard to read
and modify.

The answer may depend on the complexity of the subsystem manager, which
is obviously critical. Does the separation of the menu from the
subsystem manager contribute to significantly lower the TCB of the
subsystem manager?

It does not necessarily change the TCB, but it is done for the sake of
reusability and code readability/ease of programming. From that
perspective we think it would be nice if these things were separated,
and for instance the menu part could be used in another application as well.

This leaves the question about the input focus. When using the wm, the
focus is already defined by the window layouter via the 'focus' ROM. The
window layouter, in turn, already consumes a 'focus_request' ROM to
respond to externally triggered focus changes. This would be the right
hook for the menu / subsystem manager.

I've been looking into this mechanism, but so far it's not entirely
clear to me. Do you mean that the subsystem manager could write to this
focus_request report and the layouter would for example show/hide the
appropriate windows automatically? If so, what about the focus_requests
that come from the window manager?
In short: how would that work?

The state report generated by init already contains a 'state' attribute
for each child. Right now, the attribute is present only if the child is
"incomplete". We could add a value "exited" that would be presented as
soon as the child issued a 'Parent::exit' call. Also the exit code could
be added to the report, if needed. The subsystem manager could then
inspect the state reports for children with this attribute value and
remove them from the init config.

This is exactly what I'm looking for in that case.

Thanks,

-- 

Met vriendelijke groet / kind regards,

Boris Mulder

Cyber Security Labs B.V. | Gooimeer 6-31 | 1411 DD Naarden | The Netherlands
+31 35 631 3253 (office)