nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

ldls: ping, over a Linux driver

Browse source 
docs/plan/ldls.md L3d, and with it L3 -- the milestone the plan calls the one
that proves the whole idea and the one that cannot be skipped.

    # ldlsd /lib/modules/8139too.ko /lib/modules/btf &
      kpi: the driver read a MAC off the hardware: 52:54:00🆎cd:ef
      ndo_open returned 0
      carrying frames. the interface is ldls0.

    # cat /proc/netif
    interface ldls0   state up   address 10.9.0.15   gateway 10.9.0.2

    # ping 10.9.0.2 4
    64 bytes from 10.9.0.2: icmp_seq=1 time=30 ms
    64 bytes from 10.9.0.2: icmp_seq=2 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=3 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=4 time=20 ms

10.9.0.0/24 is reachable only through ldls0, and ldls0 is 8139too running in a
SchOS process. The address was obtained by DHCP over the same driver first.
lwIP -> netdev_ops -> /dev/netdev -> ldlsd -> ndo_start_xmit -> a BAR mapped by
/dev/pci -> the wire, and the whole way back. Nothing in the kernel knows a
Linux driver is involved; nothing in the driver knows it is not in Linux.

It polls rather than taking interrupts. /dev/pci delivers them by blocking
read(), which needs a thread this program does not have, so the driver's NAPI
poll is called from a loop instead -- the same work in a context LDLS can
provide, at the cost of latency and a spinning process.

Four things Linux's alloc_etherdev does that allocating does not, each found by
the driver faulting on it: dev->dev_addr is a pointer aimed at perm_addr;
dev->mc and dev->uc are list heads and are empty only when they point at
themselves; dev->_tx is an array of netdev_queue, because netif_start_queue
clears a bit in _tx[0].state; and __LINK_STATE_START is set by dev_open before
ndo_open is called.

Two did not announce themselves, and they are the ones worth recording.

netif_running(dev) gates 8139too's receive loop. Without it the chip received
the frame, the driver acknowledged the interrupt and left the loop, and nothing
came out -- while every counter said packets were arriving. Found by reading
the chip's own CBR register through the BAR and seeing the hardware had written
600 bytes the driver never collected.

memcpy was still a logging stub. The driver copied each frame into its sk_buff,
the copy did not happen, and the stack was handed exactly the right length of
zeroes; DHCP never completed and nothing reported an error. A stub that returns
zero is not safe for a function whose whole job is a side effect, and the
memory primitives are the worst case because they fail silently and plausibly.
ldls/kpi/string.c exists because of it.

Still one driver, one kernel version, tried once, against an emulated card --
which is what the plan has always promised and is worth repeating next to a
working ping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-14 11:14:18 +02:00
commit 888c48fd96
9 changed files with 809 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

149
ldls/kpi/kpi.c
View file

@ -17,8 +17,27 @@
#include "netuser.h"
#include "kpi.h"
struct kpi_ctx kpi;
int kpi_verbose;
struct kpi_ctx kpi;
struct kpi_layout kpi_l;
int kpi_verbose;
// The driver's NAPI poll, captured at registration. See kpi.h.
int (*kpi_napi_poll)(void *napi, int budget);
void *kpi_napi;
// netif_napi_add_weight_locked(dev, napi, poll, weight)
//
// Recorded rather than ignored, because the poll function is the receive path:
// a NAPI driver's interrupt handler only schedules, and everything that
// actually takes packets off the chip happens in here.
void
kpi_netif_napi_add(void *dev, void *napi, void *poll, int weight)
{
(void)dev; (void)weight;
kpi_napi = napi;
kpi_napi_poll = (int (*)(void *, int))poll;
kpi_log(" kpi: the driver registered a NAPI poll\n");
}
void
kpi_log(const char *s)
@ -186,6 +205,41 @@ print_fmt(const char *f)
int kpi_printk(const char *fmt) { print_fmt(fmt); return 0; }
int kpi_netdev_print(void *dev, const char *fmt) { (void)dev; print_fmt(fmt); return 0; }
// --- data, not functions -------------------------------------------------------
//
// Not every undefined symbol in a module is a call. `byte_rev_table` is a
// 256-byte lookup of bit-reversed bytes, and 8139too indexes it directly while
// computing its multicast hash. A stub trampoline resolves the name and gives
// the driver machine code to read as data -- which does not fault, and
// produces a quietly wrong answer, which is worse.
//
// The ELF symbol table cannot tell these apart: every undefined symbol in a
// module is STT_NOTYPE. BTF can (VAR against FUNC) and that is the general
// fix; this is the specific one, and the values are a fact about bit order.
static const unsigned char kpi_byte_rev_table[256] = {
0x00,0x80,0x40,0xc0,0x20,0xa0,0x60,0xe0,0x10,0x90,0x50,0xd0,0x30,0xb0,0x70,0xf0,
0x08,0x88,0x48,0xc8,0x28,0xa8,0x68,0xe8,0x18,0x98,0x58,0xd8,0x38,0xb8,0x78,0xf8,
0x04,0x84,0x44,0xc4,0x24,0xa4,0x64,0xe4,0x14,0x94,0x54,0xd4,0x34,0xb4,0x74,0xf4,
0x0c,0x8c,0x4c,0xcc,0x2c,0xac,0x6c,0xec,0x1c,0x9c,0x5c,0xdc,0x3c,0xbc,0x7c,0xfc,
0x02,0x82,0x42,0xc2,0x22,0xa2,0x62,0xe2,0x12,0x92,0x52,0xd2,0x32,0xb2,0x72,0xf2,
0x0a,0x8a,0x4a,0xca,0x2a,0xaa,0x6a,0xea,0x1a,0x9a,0x5a,0xda,0x3a,0xba,0x7a,0xfa,
0x06,0x86,0x46,0xc6,0x26,0xa6,0x66,0xe6,0x16,0x96,0x56,0xd6,0x36,0xb6,0x76,0xf6,
0x0e,0x8e,0x4e,0xce,0x2e,0xae,0x6e,0xee,0x1e,0x9e,0x5e,0xde,0x3e,0xbe,0x7e,0xfe,
0x01,0x81,0x41,0xc1,0x21,0xa1,0x61,0xe1,0x11,0x91,0x51,0xd1,0x31,0xb1,0x71,0xf1,
0x09,0x89,0x49,0xc9,0x29,0xa9,0x69,0xe9,0x19,0x99,0x59,0xd9,0x39,0xb9,0x79,0xf9,
0x05,0x85,0x45,0xc5,0x25,0xa5,0x65,0xe5,0x15,0x95,0x55,0xd5,0x35,0xb5,0x75,0xf5,
0x0d,0x8d,0x4d,0xcd,0x2d,0xad,0x6d,0xed,0x1d,0x9d,0x5d,0xdd,0x3d,0xbd,0x7d,0xfd,
0x03,0x83,0x43,0xc3,0x23,0xa3,0x63,0xe3,0x13,0x93,0x53,0xd3,0x33,0xb3,0x73,0xf3,
0x0b,0x8b,0x4b,0xcb,0x2b,0xab,0x6b,0xeb,0x1b,0x9b,0x5b,0xdb,0x3b,0xbb,0x7b,0xfb,
0x07,0x87,0x47,0xc7,0x27,0xa7,0x67,0xe7,0x17,0x97,0x57,0xd7,0x37,0xb7,0x77,0xf7,
0x0f,0x8f,0x4f,0xcf,0x2f,0xaf,0x6f,0xef,0x1f,0x9f,0x5f,0xdf,0x3f,0xbf,0x7f,0xff,
};
// jiffies, also data. Nothing advances it: the drivers hosted so far read it
// only to compare against a timeout they will never reach, because nothing
// here runs their watchdog either.
static unsigned long kpi_jiffies;
// --- the table -----------------------------------------------------------------
//
// Names on the left are Linux's and are facts. Everything on the right is ours.
@ -213,6 +267,27 @@ extern void kpi_unregister_netdev(void *dev);
extern void kpi_dev_addr_mod(void *dev, unsigned int off,
const unsigned char *addr, unsigned int len);
extern void *kpi_napi_alloc_skb(void *napi, unsigned int len);
extern void *kpi_netdev_alloc_skb(void *dev, unsigned int len);
extern void *kpi_skb_put(void *skb, unsigned int n);
extern void *kpi_skb_reserve(void *skb, int n);
extern void kpi_skb_copy_and_csum_dev(void *skb, unsigned char *to);
extern unsigned short kpi_eth_type_trans(void *skb, void *dev);
extern int kpi_netif_receive_skb(void *skb);
extern void kpi_kfree_skb(void *skb);
extern void kpi_kfree_skb_reason(void *skb, int r);
extern void *kpi_memcpy(void *d, const void *s, unsigned long n);
extern void *kpi_memmove(void *d, const void *s, unsigned long n);
extern void *kpi_memset(void *d, int c, unsigned long n);
extern int kpi_memcmp(const void *a, const void *b, unsigned long n);
extern unsigned long kpi_strlen(const char *s);
extern unsigned long kpi_strnlen(const char *s, unsigned long max);
extern long kpi_sized_strscpy(char *d, const char *s, unsigned long n);
extern void kpi_memcpy_fromio(void *d, const void *s, unsigned long n);
extern void kpi_memcpy_toio(void *d, const void *s, unsigned long n);
extern void kpi_fortify_panic(void);
const struct kpi_sym kpi_table[] = {
// PCI
{ "pci_enable_device", (void *)kpi_pci_enable_device },
@ -248,6 +323,24 @@ const struct kpi_sym kpi_table[] = {
{ "unregister_netdev", (void *)kpi_unregister_netdev },
{ "dev_addr_mod", (void *)kpi_dev_addr_mod },
// Data, not functions. See the note above kpi_byte_rev_table.
{ "byte_rev_table", (void *)kpi_byte_rev_table },
{ "jiffies", (void *)&kpi_jiffies },
// Bytes. Not optional, and not safe to stub -- see ldls/kpi/string.c.
{ "memcpy", (void *)kpi_memcpy },
{ "__memcpy", (void *)kpi_memcpy },
{ "memmove", (void *)kpi_memmove },
{ "memset", (void *)kpi_memset },
{ "__memset", (void *)kpi_memset },
{ "memcmp", (void *)kpi_memcmp },
{ "strlen", (void *)kpi_strlen },
{ "strnlen", (void *)kpi_strnlen },
{ "sized_strscpy", (void *)kpi_sized_strscpy },
{ "memcpy_fromio", (void *)kpi_memcpy_fromio },
{ "memcpy_toio", (void *)kpi_memcpy_toio },
{ "__fortify_panic", (void *)kpi_fortify_panic },
// Printing
{ "_printk", (void *)kpi_printk },
{ "netdev_info", (void *)kpi_netdev_print },
@ -255,6 +348,58 @@ const struct kpi_sym kpi_table[] = {
{ "_dev_info", (void *)kpi_netdev_print },
{ "_dev_err", (void *)kpi_netdev_print },
// Packets
{ "napi_alloc_skb", (void *)kpi_napi_alloc_skb },
{ "__napi_alloc_skb", (void *)kpi_napi_alloc_skb },
{ "__netdev_alloc_skb", (void *)kpi_netdev_alloc_skb },
{ "skb_put", (void *)kpi_skb_put },
{ "skb_reserve", (void *)kpi_skb_reserve },
{ "skb_copy_and_csum_dev", (void *)kpi_skb_copy_and_csum_dev },
{ "eth_type_trans", (void *)kpi_eth_type_trans },
{ "netif_receive_skb", (void *)kpi_netif_receive_skb },
{ "napi_gro_receive", (void *)kpi_netif_receive_skb },
{ "dev_kfree_skb_any_reason",(void *)kpi_kfree_skb_reason },
{ "consume_skb", (void *)kpi_kfree_skb },
{ "kfree_skb_reason", (void *)kpi_kfree_skb_reason },
// Bringing the interface up. LDLS polls rather than taking interrupts, so
// request_irq succeeds and nothing is ever delivered through it -- see the
// note in cmd/ldlsd on why a poll loop is the honest shape here.
{ "request_threaded_irq", (void *)kpi_zero },
{ "free_irq", (void *)kpi_nop },
{ "enable_irq", (void *)kpi_nop },
{ "disable_irq_nosync", (void *)kpi_nop },
{ "napi_enable", (void *)kpi_nop },
{ "napi_enable_locked", (void *)kpi_nop },
{ "napi_disable", (void *)kpi_nop },
{ "napi_disable_locked", (void *)kpi_nop },
{ "__napi_schedule", (void *)kpi_nop },
{ "napi_schedule_prep", (void *)kpi_one },
{ "napi_complete_done", (void *)kpi_one },
{ "netif_tx_wake_queue", (void *)kpi_nop },
{ "netif_device_attach", (void *)kpi_nop },
{ "netif_device_detach", (void *)kpi_nop },
{ "netif_napi_add_weight_locked", (void *)kpi_netif_napi_add },
// The PHY. 8139too reaches it through the mii helpers, which call back into
// the driver's own mdio routines -- so "the link is up" is the only thing
// this has to say, and saying anything else stops the driver bringing the
// interface up at all.
{ "mii_link_ok", (void *)kpi_one },
{ "mii_nway_restart", (void *)kpi_zero },
{ "mii_check_media", (void *)kpi_nop },
{ "generic_mii_ioctl", (void *)kpi_zero },
{ "mii_ethtool_get_link_ksettings", (void *)kpi_zero },
{ "mii_ethtool_set_link_ksettings", (void *)kpi_zero },
// Deferred work. Nothing here runs it: the driver's periodic thread is a
// watchdog, and a watchdog that never fires is better than one firing in a
// context this host cannot provide.
{ "queue_delayed_work_on", (void *)kpi_one },
{ "cancel_delayed_work_sync",(void *)kpi_zero },
{ "delayed_work_timer_fn", (void *)kpi_nop },
{ "wake_up_process", (void *)kpi_one },
// Things a driver calls at probe that need only to return sensibly. Each is
// here because 8139too calls it and because doing nothing is the right
// answer in one process -- see the note above kpi_nop().