doc(kb): update knowledge graph wiki, summary and top-level README for adapter/syscall

Update the supporting knowledge-base documents in docs/ and
docs/zh_cn/ so they stay aligned with adapter/syscall/README.md and
the freshly updated L1/L2 architecture docs.

  - docs/KNOWLEDGE_GRAPH_WIKI.md and the zh_cn counterpart:
      Expand Section 5.2 'Adapter Layer' from a four-row mini-table
      into a more complete file inventory of adapter/syscall/ that
      covers ff_hook_syscall.c/.h, ff_linux_syscall.c,
      ff_declare_syscalls.h, ff_socket_ops.c/.h, ff_sysproto.h,
      ff_so_zone.c, ff_event.c, ff_epoll.c, ff_ring_ops.c/.h and
      Makefile, and add a short paragraph describing the two-process
      LD_PRELOAD model and the FF_KERNEL_EVENT / FF_MULTI_SC /
      FF_USE_RING_IPC switches.

  - docs/F-Stack_Knowledge_Base_Summary.md and the zh_cn counterpart:
      Augment the 'LD_PRELOAD integration method' bullet and the
      'Application Integration' learning-path entry with concrete
      keywords (libff_syscall.so, fork, accept4, __recv_chk, epoll
      polling mode, FF_USE_RING_IPC ring IPC) and a reference to
      adapter/syscall/README.md.

  - docs/README.md and the zh_cn counterpart:
      Tighten the source-tree comment for adapter/ to mention both
      micro_thread and syscall, and to call out that the syscall
      subdirectory builds libff_syscall.so for LD_PRELOAD.

No structural / TOC changes; only inline updates pointing at
adapter/syscall/README.md as the single source of truth. Line endings
normalized to LF.

Author: jfb8856606

docs/F-Stack_Knowledge_Base_Summary.md

@@ -212,7 +212,7 @@ Application Development Guidelines
 
 Tools and Integration
   → 11 IPC operations tools
-  → LD_PRELOAD integration method
+  → LD_PRELOAD integration method (libff_syscall.so: fork / accept4 / __recv_chk / epoll polling / FF_USE_RING_IPC ring IPC)
   → Application integration interfaces
 ```
 
@@ -592,7 +592,7 @@ Issue 4: Multi-process synchronization issues
    → Study causes of network packet loss
 
 4. Application Integration
-   → Learn LD_PRELOAD mechanism
+   → Learn the LD_PRELOAD mechanism (libff_syscall.so in adapter/syscall/, see adapter/syscall/README.md)
    → Study Nginx/Redis integration methods
    → Develop custom integration solutions
 ```

docs/KNOWLEDGE_GRAPH_WIKI.md

@@ -240,12 +240,27 @@ f-stack/
 
 ### 5.2 Adapter Layer (`adapter/`)
 
+The `adapter/syscall/` directory builds two binaries — `libff_syscall.so` (preloaded
+into the user application) and a standalone `fstack` instance — that together
+implement the LD_PRELOAD path. Key files:
+
 | File | Responsibility |
 |------|---------------|
-| `syscall/ff_hook_syscall.c` | LD_PRELOAD system call interception (3254 lines) |
-| `syscall/ff_socket_ops.h` / `.c` | Socket operation context and handling |
-| `syscall/ff_so_zone.c` | Shared memory zone management |
-| `syscall/ff_epoll.c` | Epoll adaptation |
+| `syscall/ff_hook_syscall.c` / `.h` | LD_PRELOAD POSIX hooks: `socket/bind/connect/accept/accept4/listen/close/read/write/send*/recv*/__read_chk/__recv_chk/__recvfrom_chk/ioctl/epoll_*/fork` etc., dispatched to ff_* via shared memory |
+| `syscall/ff_linux_syscall.c` / `ff_declare_syscalls.h` | Linux-flag to FreeBSD-flag translation (e.g. `LINUX_SOCK_CLOEXEC`, `LINUX_SOCK_NONBLOCK`) and hook declarations |
+| `syscall/ff_socket_ops.h` / `.c` | Per-socket operation context (`sc`) and the producer/consumer dispatch logic between the application and the fstack instance |
+| `syscall/ff_sysproto.h` | Cross-boundary syscall argument struct definitions |
+| `syscall/ff_so_zone.c` | Hugepage shared-memory zone management (semaphore IPC path) |
+| `syscall/ff_event.c` / `ff_epoll.c` | Epoll adaptation (incl. polling mode) and event delivery |
+| `syscall/ff_ring_ops.c` / `.h` *(FF_USE_RING_IPC)* | Lock-free DPDK SPSC `rte_ring` IPC path; replaces the `ff_so_zone` global lock |
+| `syscall/Makefile` | Builds both `libff_syscall.so` and the `fstack` instance binary |
+
+LD_PRELOAD-mode applications run as **two separate processes**: the `fstack`
+instance (links libfstack.a + DPDK) plus the user app preloaded with
+`libff_syscall.so`. The two communicate over Hugepage shared memory — sem-based by
+default, or a lock-free DPDK SPSC ring when `FF_USE_RING_IPC=1` is set. Compile /
+runtime switches `FF_KERNEL_EVENT`, `FF_MULTI_SC` and `FF_USE_RING_IPC` further tune
+behavior; full details in `adapter/syscall/README.md` and `docs/ld_preload_ring_spec/`.
 
 ---
 

docs/README.md

@@ -288,7 +288,7 @@ Total lines: ~5839 lines (based on actual file count)
 ├── lib/               # Core library (~21K lines)
 ├── freebsd/           # FreeBSD protocol stack port
 ├── dpdk/              # DPDK 23.11.5 dependency
-├── adapter/           # Middleware adapters, LD_PRELOAD and micro_thread
+├── adapter/           # Middleware adapters: micro_thread + syscall (builds libff_syscall.so for LD_PRELOAD)
 ├── example/           # Application examples (main.c recommended)
 ├── app/               # Nginx/Redis integration
 ├── tools/             # Operations tools

docs/zh_cn/F-Stack_Knowledge_Base_Summary.md

@@ -212,7 +212,7 @@ F-Stack 架构知识库
 
 工具与集成
   → 11 个 IPC 运维工具
-  → LD_PRELOAD 集成方式
+  → LD_PRELOAD 集成方式（libff_syscall.so：fork / accept4 / __recv_chk / epoll polling / FF_USE_RING_IPC ring IPC）
   → 应用集成接口
 ```
 
@@ -592,7 +592,7 @@ net.inet.tcp.functions_default=bbr    # BBR 算法 (高延迟网络), freebsd/ra
    → 研究网络丢包原因
 
 4. 应用集成
-   → 学习 LD_PRELOAD 机制
+   → 学习 LD_PRELOAD 机制（adapter/syscall/ 下的 libff_syscall.so，参见 adapter/syscall/README.md）
    → 研究 Nginx/Redis 集成方式
    → 开发自定义集成方案
 ```

docs/zh_cn/KNOWLEDGE_GRAPH_WIKI.md

@@ -240,12 +240,25 @@ f-stack/
 
 ### 5.2 适配器层 (`adapter/`)
 
+`adapter/syscall/` 同时构建出 `libff_syscall.so`（被预加载到用户应用进程）与独立的
+`fstack` 实例二进制，二者共同实现 LD_PRELOAD 模式。主要文件如下：
+
 | 文件 | 职责 |
 |------|------|
-| `syscall/ff_hook_syscall.c` | LD_PRELOAD 系统调用劫持（3254 行） |
-| `syscall/ff_socket_ops.h` / `.c` | Socket 操作上下文和处理 |
-| `syscall/ff_so_zone.c` | 共享内存区域管理 |
-| `syscall/ff_epoll.c` | Epoll 适配 |
+| `syscall/ff_hook_syscall.c` / `.h` | LD_PRELOAD POSIX hook：`socket/bind/connect/accept/accept4/listen/close/read/write/send*/recv*/__read_chk/__recv_chk/__recvfrom_chk/ioctl/epoll_*/fork` 等，经共享内存转发给 ff_* |
+| `syscall/ff_linux_syscall.c` / `ff_declare_syscalls.h` | Linux 标志位到 FreeBSD 标志位的转换（如 `LINUX_SOCK_CLOEXEC`、`LINUX_SOCK_NONBLOCK`）与 hook 声明 |
+| `syscall/ff_socket_ops.h` / `.c` | 单 socket 操作上下文（`sc`）以及应用与 fstack 实例之间的生产/消费派发逻辑 |
+| `syscall/ff_sysproto.h` | 跨进程的 syscall 参数结构定义 |
+| `syscall/ff_so_zone.c` | Hugepage 共享内存 zone 管理（信号量 IPC 路径） |
+| `syscall/ff_event.c` / `ff_epoll.c` | Epoll 适配（含 polling 模式）与事件投递 |
+| `syscall/ff_ring_ops.c` / `.h` *(FF_USE_RING_IPC)* | Lock-free DPDK SPSC `rte_ring` IPC 路径，移除 `ff_so_zone` 全局锁 |
+| `syscall/Makefile` | 同时编译 `libff_syscall.so` 与 `fstack` 实例二进制 |
+
+LD_PRELOAD 模式下应用以 **两个独立进程** 运行：`fstack` 实例（链接 libfstack.a + DPDK）
+与预加载 `libff_syscall.so` 的用户应用。二者通过 Hugepage 共享内存通信——默认走信号量
+路径，置 `FF_USE_RING_IPC=1` 后切换为 lock-free DPDK SPSC ring 路径。编译/运行期开关
+`FF_KERNEL_EVENT`、`FF_MULTI_SC`、`FF_USE_RING_IPC` 用于进一步调整行为；完整说明参见
+`adapter/syscall/README.md` 与 `docs/ld_preload_ring_spec/`。
 
 ---
 

docs/zh_cn/README.md

@@ -288,7 +288,7 @@ DPDK 版本: 23.11.5
 ├── lib/               # 核心库 (~21K 行)
 ├── freebsd/           # FreeBSD 协议栈移植
 ├── dpdk/              # DPDK 23.11.5 依赖
-├── adapter/           # 中间适配器，LD_PRELOAD和micro_thread
+├── adapter/           # 中间适配器：micro_thread + syscall（构建 libff_syscall.so 供 LD_PRELOAD 使用）
 ├── example/           # 应用示例 (main.c 推荐)
 ├── app/               # Nginx/Redis 集成
 ├── tools/             # 运维工具