nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

ldls: ping, over a Linux driver

Browse source 
docs/plan/ldls.md L3d, and with it L3 -- the milestone the plan calls the one
that proves the whole idea and the one that cannot be skipped.

    # ldlsd /lib/modules/8139too.ko /lib/modules/btf &
      kpi: the driver read a MAC off the hardware: 52:54:00🆎cd:ef
      ndo_open returned 0
      carrying frames. the interface is ldls0.

    # cat /proc/netif
    interface ldls0   state up   address 10.9.0.15   gateway 10.9.0.2

    # ping 10.9.0.2 4
    64 bytes from 10.9.0.2: icmp_seq=1 time=30 ms
    64 bytes from 10.9.0.2: icmp_seq=2 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=3 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=4 time=20 ms

10.9.0.0/24 is reachable only through ldls0, and ldls0 is 8139too running in a
SchOS process. The address was obtained by DHCP over the same driver first.
lwIP -> netdev_ops -> /dev/netdev -> ldlsd -> ndo_start_xmit -> a BAR mapped by
/dev/pci -> the wire, and the whole way back. Nothing in the kernel knows a
Linux driver is involved; nothing in the driver knows it is not in Linux.

It polls rather than taking interrupts. /dev/pci delivers them by blocking
read(), which needs a thread this program does not have, so the driver's NAPI
poll is called from a loop instead -- the same work in a context LDLS can
provide, at the cost of latency and a spinning process.

Four things Linux's alloc_etherdev does that allocating does not, each found by
the driver faulting on it: dev->dev_addr is a pointer aimed at perm_addr;
dev->mc and dev->uc are list heads and are empty only when they point at
themselves; dev->_tx is an array of netdev_queue, because netif_start_queue
clears a bit in _tx[0].state; and __LINK_STATE_START is set by dev_open before
ndo_open is called.

Two did not announce themselves, and they are the ones worth recording.

netif_running(dev) gates 8139too's receive loop. Without it the chip received
the frame, the driver acknowledged the interrupt and left the loop, and nothing
came out -- while every counter said packets were arriving. Found by reading
the chip's own CBR register through the BAR and seeing the hardware had written
600 bytes the driver never collected.

memcpy was still a logging stub. The driver copied each frame into its sk_buff,
the copy did not happen, and the stack was handed exactly the right length of
zeroes; DHCP never completed and nothing reported an error. A stub that returns
zero is not safe for a function whose whole job is a side effect, and the
memory primitives are the worst case because they fail silently and plausibly.
ldls/kpi/string.c exists because of it.

Still one driver, one kernel version, tried once, against an emulated card --
which is what the plan has always promised and is worth repeating next to a
working ping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-14 11:14:18 +02:00
commit 888c48fd96
9 changed files with 809 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

99
ldls/kpi/net.c
View file

@ -33,6 +33,14 @@ unsigned int kpi_netdev_size;
static void *g_netdev; // the one interface, for register_netdev
// What alloc_etherdev_mqs handed back.
//
// The host needs it to reach ndo_open and ndo_start_xmit, and it is not the
// pci_dev -- passing that instead reads netdev_ops out of the middle of a
// different struct and finds nothing, which is exactly what happened the first
// time this was wired up.
void *kpi_netdev(void) { return g_netdev; }
void *
kpi_alloc_etherdev_mqs(int priv, unsigned int txqs, unsigned int rxqs)
{
@ -53,6 +61,78 @@ kpi_alloc_etherdev_mqs(int priv, unsigned int txqs, unsigned int rxqs)
if (p == 0 || (long)p == -1)
return 0;
// Linux's alloc_etherdev does more than allocate, and one of the things it
// does is not optional: `dev->dev_addr` is a *pointer*, aimed at the
// device's own `perm_addr` array. A driver programs its MAC into the chip
// with `*(u32 *)dev->dev_addr`, so leaving it null is a null dereference
// inside the driver's hardware setup -- which is exactly where this stopped
// the first time.
if (kpi_l.nd_dev_addr && kpi_l.nd_perm_addr) {
unsigned char *d = (unsigned char *)p;
unsigned char *perm = d + kpi_l.nd_perm_addr;
int i;
for (i = 0; i < 8; i++)
d[kpi_l.nd_dev_addr + i] = (unsigned char)((unsigned long)perm >> (i * 8));
if (kpi_l.nd_addr_len)
d[kpi_l.nd_addr_len] = 6;
} else {
kpi_log("kpi: no net_device.dev_addr offset -- the driver will fault\n");
}
// The address lists have to be *empty*, not zeroed.
//
// A Linux list_head is empty when it points at itself; zeroed means a null
// `next`, and the first thing that walks it dereferences that. 8139too walks
// the multicast list in its receive-mode setup, so this is reached on the
// way to bringing the interface up -- and it is the second thing Linux's
// alloc_etherdev does that allocating alone does not.
if (kpi_l.nd_mc && kpi_l.nd_uc) {
unsigned int heads[2];
int h;
heads[0] = kpi_l.nd_mc;
heads[1] = kpi_l.nd_uc;
for (h = 0; h < 2; h++) {
unsigned char *lh = (unsigned char *)p + heads[h];
unsigned long self = (unsigned long)lh;
int i;
for (i = 0; i < 8; i++) {
lh[i] = (unsigned char)(self >> (i * 8)); /* next */
lh[8 + i] = (unsigned char)(self >> (i * 8)); /* prev */
}
}
}
// And the transmit queues, which are an array hanging off the device rather
// than part of it.
//
// `netif_start_queue` is an inline that clears a bit in `dev->_tx[0].state`,
// so a driver bringing its interface up writes through this pointer before
// it sends anything. Allocating it is the third thing Linux's alloc_etherdev
// does that allocating the device alone does not -- and like the other two,
// it was found by the driver faulting on it rather than by reading a list.
if (kpi_l.nd_tx && kpi_l.nq_size) {
unsigned int n = txqs ? txqs : 1;
unsigned char *q = mmap(0, (unsigned long)n * kpi_l.nq_size,
PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (q && (long)q != -1) {
unsigned char *d = (unsigned char *)p;
unsigned int k;
int i;
for (i = 0; i < 8; i++)
d[kpi_l.nd_tx + i] = (unsigned char)((unsigned long)q >> (i * 8));
for (k = 0; k < n; k++) {
unsigned char *e = q + (unsigned long)k * kpi_l.nq_size;
for (i = 0; i < 8; i++)
e[kpi_l.nq_dev + i] = (unsigned char)((unsigned long)p >> (i * 8));
}
for (i = 0; i < 4; i++) {
d[kpi_l.nd_num_tx + i] = (unsigned char)(n >> (i * 8));
d[kpi_l.nd_real_num_tx + i] = (unsigned char)(n >> (i * 8));
}
}
}
kpi_log(" kpi: net_device "); kpi_lognum(kpi_netdev_size);
kpi_log(" bytes + "); kpi_lognum(priv); kpi_log(" private\n");
@ -78,7 +158,7 @@ void
kpi_dev_addr_mod(void *dev, unsigned int off, const unsigned char *addr,
unsigned int len)
{
unsigned int i;
int i;
(void)dev;
if (off != 0 || len != 6 || !addr)
@ -88,6 +168,18 @@ kpi_dev_addr_mod(void *dev, unsigned int off, const unsigned char *addr,
kpi.mac[i] = addr[i];
kpi.have_mac = 1;
// And through dev->dev_addr, which is where the driver will read it back
// from when it programs the chip.
if (g_netdev && kpi_l.nd_dev_addr) {
unsigned char *d = (unsigned char *)g_netdev;
unsigned long q = 0;
for (i = 0; i < 8; i++)
q |= (unsigned long)d[kpi_l.nd_dev_addr + i] << (i * 8);
if (q)
for (i = 0; i < 6; i++)
((unsigned char *)q)[i] = addr[i];
}
kpi_log(" kpi: the driver read a MAC off the hardware: ");
for (i = 0; i < 6; i++) {
kpi_loghex(kpi.mac[i], 2);
@ -114,7 +206,10 @@ kpi_register_netdev(void *dev)
return -1;
}
kpi.netfd = open("/dev/netdev", O_RDWR);
// Non-blocking, because the host's loop has to give the receive side a turn
// whether or not the stack has anything to send. netuser_ready() is what
// makes O_NONBLOCK work here; see struct devsw.
kpi.netfd = open("/dev/netdev", O_RDWR | O_NONBLOCK);
if (kpi.netfd < 0) {
kpi_log("kpi: cannot open /dev/netdev\n");
return -1;