ldls: being the PCI core, with offsets nobody wrote down
docs/plan/ldls.md milestone L2, less the half that needs /dev/pci.
In Linux, __pci_register_driver ends at the PCI core, which matches a
driver's id_table against the bus and calls probe(). There is no PCI core
here, so LDLS keeps the pointer that call was given and plays the part.
To do that it must know where pci_driver.probe is, and it asks the kernel
rather than being told by us. ldls/btf.c reads /sys/kernel/btf/vmlinux --
122,279 types, every struct layout and every function prototype, as generated
data describing the kernel that is installed. Implemented from
Documentation/bpf/btf.rst, which is a published specification.
$ ldls-types /sys/kernel/btf/vmlinux --need
pci_driver probe offset 16 size 8
pci_dev resource offset 1000 size 1088
resource start offset 0 size 8
all present
Cross-checked against pahole on the same file, field for field. No offset in
this is ours, which is rule 3's uncomfortable row disappearing rather than
being argued about.
And then the driver:
driver name "8139too"
devices it claims: 10ec:8139 ... and 16 more
calling probe(pci_dev 10ec:8139, ...)
1 alloc_etherdev_mqs(0x368, 1, 1)
2 pci_enable_device / 3 pci_request_regions / 4 pci_set_master
5 pci_iomap(pdev, 1, 0)
6..544 ioread8 / iowrite8 -- 0x88, 0x8a, 0x8c, 0x8e, over and over
545 dev_addr_mod / 547 netif_napi_add_weight_locked
549 timer_init_key / 550 register_netdev / 551 netdev_info
probe returned 0 after 552 stub call(s)
10ec:8139 is the real RTL8139 id. It mapped BAR 1, the one marked
IORESOURCE_MEM. Those 538 alternating byte accesses stepping 0x88/0x8a/0x8c/
0x8e are serial EEPROM clocking -- the driver bit-banging the chip for its MAC
address and handing the result to dev_addr_mod. Then NAPI, a watchdog timer,
register_netdev, its "found it" line, and zero.
Fifteen distinct symbols carry that entire probe, and three of them are 540 of
the 552 calls. L1 said 44 symbols carry 110 modules through init; L2 says 15
carry this one through probe. Neither is a number anyone would have guessed
and both came from running the thing.
Recorded as not done, because it is not: probe receives a pci_dev whose shape
is right and whose contents are invented. The BARs are made up, pci_iomap
returns a zeroed page, and 8139too read a MAC address of zeroes and was
perfectly happy about it. The "all through /dev/pci" half of L2 belongs to the
SchOS side. Also recorded: BTF has to come from somewhere, and SchOS has no
/sys/kernel/btf/vmlinux -- the user brings it with the module, from the kernel
the module was built for.
make ldls-check is 27 checks, four of them L2's, and it says so out loud when
it skips them on a machine with no BTF rather than passing silently.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz
parent
7dd2b03e36
commit
2d9a0ec6e3
8 changed files with 978 additions and 9 deletions
|
|
@ -95,7 +95,7 @@ The galling ones. The work exists, is tested, and nothing uses it.
|
|||
|---|---|
|
||||
| **`foundations.md`** | Item 1 built. Items 2 (a shareable memory object), 3 (`AF_UNIX` in the filesystem namespace), 4 and 5 open. **Wayland stops at item 2.** |
|
||||
| ~~**`hybrid.md`**~~ | **Closed.** All four mechanisms built; H1, H2 and H3 done. H4 — the USB eviction — is *withdrawn* rather than outstanding: USB is the bus peripherals arrive on, not a peripheral, and an eviction that has to leave an identical driver behind has moved nothing. See [hybrid.md](hybrid.md), "Decided: USB stays in the kernel". |
|
||||
| **`ldls.md`** | L0 and L1 done — the loader handles 2,440 stock modules, and 449 of 500 run their `init_module` to completion against stubs. L2 (the hardware) and L3 (a packet) open. Every symbol is still a stub that logs and returns zero. |
|
||||
| **`ldls.md`** | L0, L1 and L2 done — the loader handles 2,440 stock modules; 449 of 500 run `init_module`; and `8139too`'s `probe()` runs to completion and returns 0, reached through struct offsets read from the kernel's own BTF. L3 (a packet, and the `/dev/pci` back end) open. The hardware is still invented. |
|
||||
| **Schcom v0** | 715 lines that composite, over a wire format that is superseded. Frozen: it runs, nothing more is added, and it is kept only because it is the one thing in the tree that has ever put a client's pixels on screen. |
|
||||
| **`debugger.md`** | D0 through D4 built and described in [../architecture/debugging.md](../architecture/debugging.md). Only the network transport is open — a userspace daemon bridging TCP to `/dev/dbg`, which is deliberately last. |
|
||||
|
||||
|
|
|
|||
|
|
@ -180,7 +180,7 @@ One device, one process, claimed and released, on the `/dev/pci` discipline.
|
|||
|---|---|---|
|
||||
| **L0** | **The loader.** Parse a real `.ko`, lay it out, relocate it, and **print every unresolved symbol**. Nothing executes. The output is the measured API surface. | **done** — `ldls/ko.c`, `make ldls-check` |
|
||||
| **L1** | **Stubs.** Every symbol resolves, to a function that logs its name. `init_module` runs, which yields the *call order* — the second thing you need and the other thing you cannot guess. | **done** — `ldls/stub.c`, `ldls-run` |
|
||||
| **L2** | **The hardware.** `probe()` receives a working `struct pci_dev`, maps its BARs, allocates coherent DMA and registers an interrupt, all through `/dev/pci`. The driver reaches its device. | |
|
||||
| **L2** | **The hardware.** `probe()` receives a working `struct pci_dev`, maps its BARs, allocates coherent DMA and registers an interrupt, all through `/dev/pci`. The driver reaches its device. | **done**, except `/dev/pci` — see below |
|
||||
| **L3** | **A packet.** The process-backed netdev, wired to the driver's transmit and receive paths. **`ping` over a Linux driver.** This is the milestone that proves the whole idea and the one that cannot be skipped. | |
|
||||
| **L4** | **Kill it.** The host process dies, the kernel clears bus mastering and reclaims the DMA, a new host starts and the interface comes back. | free — H2 built all of this |
|
||||
|
||||
|
|
@ -373,6 +373,99 @@ the kernel, not the module, is supposed to call. Reaching that is L2.
|
|||
|
||||
---
|
||||
|
||||
## L2, and being the PCI core
|
||||
|
||||
In Linux, `__pci_register_driver` ends at the PCI core, which matches the
|
||||
driver's `id_table` against the bus and calls `probe()`. There is no PCI core
|
||||
here, so LDLS keeps the pointer that call was given and plays the part itself.
|
||||
|
||||
To do that it has to know where `pci_driver.probe` is — and **it asks the
|
||||
kernel rather than being told by us**. `ldls/btf.c` reads
|
||||
`/sys/kernel/btf/vmlinux`: 122,279 types, every struct layout and every
|
||||
function prototype, as generated data describing the kernel that is installed.
|
||||
|
||||
```
|
||||
$ ldls-types /sys/kernel/btf/vmlinux --need
|
||||
pci_driver probe offset 16 size 8
|
||||
pci_driver id_table offset 8 size 8
|
||||
pci_dev vendor offset 60 size 2
|
||||
pci_dev resource offset 1000 size 1088
|
||||
resource start offset 0 size 8
|
||||
...
|
||||
all present
|
||||
```
|
||||
|
||||
Cross-checked against `pahole` on the same file, field for field. **No offset
|
||||
in this is ours**, which is rule 3's uncomfortable row disappearing rather than
|
||||
being argued about.
|
||||
|
||||
### What the driver then did
|
||||
|
||||
```
|
||||
pci_driver at 0x41662400, from BTF: probe +16, id_table +8
|
||||
driver name "8139too"
|
||||
|
||||
devices it claims:
|
||||
10ec:8139 class 000000/000000
|
||||
... and 16 more
|
||||
|
||||
calling probe(pci_dev 10ec:8139, ...)
|
||||
|
||||
1 alloc_etherdev_mqs(0x368, 0x1, 0x1)
|
||||
2 pci_enable_device(...)
|
||||
3 pci_request_regions(...)
|
||||
4 pci_set_master(...)
|
||||
5 pci_iomap(pdev, 1, 0)
|
||||
6..544 ioread8 / iowrite8 -- 0x88, 0x8a, 0x8c, 0x8e, over and over
|
||||
545 dev_addr_mod(...)
|
||||
547 netif_napi_add_weight_locked(...)
|
||||
549 timer_init_key(...)
|
||||
550 register_netdev(...)
|
||||
551 netdev_info(...)
|
||||
| %s at 0x%p, %pM, IRQ %d
|
||||
|
||||
probe returned 0 after 552 stub call(s)
|
||||
```
|
||||
|
||||
`10ec:8139` is the real RTL8139 id. The driver mapped **BAR 1**, which is the
|
||||
one we marked `IORESOURCE_MEM`. And those 538 alternating byte accesses with
|
||||
values stepping `0x88, 0x8a, 0x8c, 0x8e` are **serial EEPROM clocking** — the
|
||||
driver bit-banging the chip to read its MAC address, then handing the result to
|
||||
`dev_addr_mod`. It registered a NAPI instance, started a watchdog timer,
|
||||
registered the interface, printed its "found it" line, and **returned 0**.
|
||||
|
||||
That is a complete driver bring-up, on shape alone.
|
||||
|
||||
### Fifteen symbols
|
||||
|
||||
The whole of that probe touches **15 distinct symbols**, and 538 of the 552
|
||||
calls are two of them:
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| `ioread8` / `iowrite8` / `ioread32` | 540 calls, 3 symbols |
|
||||
| PCI setup | `pci_enable_device`, `pci_request_regions`, `pci_set_master`, `pci_iomap` |
|
||||
| net | `alloc_etherdev_mqs`, `dev_addr_mod`, `netif_napi_add_weight_locked`, `register_netdev`, `netdev_info` |
|
||||
| other | `mutex_lock`, `mutex_unlock`, `timer_init_key` |
|
||||
|
||||
L1 said 44 symbols carry 110 modules through init. L2 says 15 carry this one
|
||||
through probe. **Neither is a number anyone would have guessed**, and both came
|
||||
out of running the thing rather than reading about it.
|
||||
|
||||
### What is not done
|
||||
|
||||
`probe()` receives a `pci_dev` whose *shape* is right and whose *contents are
|
||||
invented*. The BARs are numbers this harness made up; `pci_iomap` returns a
|
||||
zeroed page, not a mapping; nothing has touched hardware and nothing could,
|
||||
because this runs on the build machine.
|
||||
|
||||
**The half of L2 that says "all through `/dev/pci`" belongs to the SchOS
|
||||
side**, where those calls have somewhere real to land. What is settled is the
|
||||
part that had to come first: that probe can be reached at all, with a struct
|
||||
the driver accepts, built from offsets nobody wrote down.
|
||||
|
||||
---
|
||||
|
||||
## What it will not do
|
||||
|
||||
- **It is not a security boundary, and here that is worse than usual.** There
|
||||
|
|
@ -418,6 +511,15 @@ the kernel, not the module, is supposed to call. Reaching that is L2.
|
|||
- **`ldls-run` is a development harness, not the deliverable.** It runs on the
|
||||
build machine so that loader failures cost a second instead of a boot. The
|
||||
thing that ships is the SchOS-side host.
|
||||
- **BTF has to come from somewhere.** On Linux it is `/sys/kernel/btf/vmlinux`.
|
||||
SchOS has no such file and never will — so the user brings the BTF along with
|
||||
the module, from the kernel the module was built for. Both are theirs,
|
||||
neither is shipped, and a kernel built without `CONFIG_DEBUG_INFO_BTF` has
|
||||
neither.
|
||||
- **`probe()` is reached with invented hardware.** The BARs are numbers the
|
||||
harness made up and `pci_iomap` returns a zeroed page. A driver that reads a
|
||||
status register gets whatever was there, which is why 8139too read a MAC
|
||||
address of zeroes and was perfectly happy about it.
|
||||
- **It will not support "Linux drivers".** It will support *one driver, on one
|
||||
kernel version, that has been tried*. Anything beyond that is a claim, and
|
||||
the list of what has actually been run belongs in the architecture document
|
||||
|
|
|
|||
Loading…
Reference in a new issue