ldls: ping, over a Linux driver

docs/plan/ldls.md L3d, and with it L3 -- the milestone the plan calls the one
that proves the whole idea and the one that cannot be skipped.

    # ldlsd /lib/modules/8139too.ko /lib/modules/btf &
      kpi: the driver read a MAC off the hardware: 52:54:00🆎cd:ef
      ndo_open returned 0
      carrying frames. the interface is ldls0.

    # cat /proc/netif
    interface ldls0   state up   address 10.9.0.15   gateway 10.9.0.2

    # ping 10.9.0.2 4
    64 bytes from 10.9.0.2: icmp_seq=1 time=30 ms
    64 bytes from 10.9.0.2: icmp_seq=2 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=3 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=4 time=20 ms

10.9.0.0/24 is reachable only through ldls0, and ldls0 is 8139too running in a
SchOS process. The address was obtained by DHCP over the same driver first.
lwIP -> netdev_ops -> /dev/netdev -> ldlsd -> ndo_start_xmit -> a BAR mapped by
/dev/pci -> the wire, and the whole way back. Nothing in the kernel knows a
Linux driver is involved; nothing in the driver knows it is not in Linux.

It polls rather than taking interrupts. /dev/pci delivers them by blocking
read(), which needs a thread this program does not have, so the driver's NAPI
poll is called from a loop instead -- the same work in a context LDLS can
provide, at the cost of latency and a spinning process.

Four things Linux's alloc_etherdev does that allocating does not, each found by
the driver faulting on it: dev->dev_addr is a pointer aimed at perm_addr;
dev->mc and dev->uc are list heads and are empty only when they point at
themselves; dev->_tx is an array of netdev_queue, because netif_start_queue
clears a bit in _tx[0].state; and __LINK_STATE_START is set by dev_open before
ndo_open is called.

Two did not announce themselves, and they are the ones worth recording.

netif_running(dev) gates 8139too's receive loop. Without it the chip received
the frame, the driver acknowledged the interrupt and left the loop, and nothing
came out -- while every counter said packets were arriving. Found by reading
the chip's own CBR register through the BAR and seeing the hardware had written
600 bytes the driver never collected.

memcpy was still a logging stub. The driver copied each frame into its sk_buff,
the copy did not happen, and the stack was handed exactly the right length of
zeroes; DHCP never completed and nothing reported an error. A stub that returns
zero is not safe for a function whose whole job is a side effect, and the
memory primitives are the worst case because they fail silently and plausibly.
ldls/kpi/string.c exists because of it.

Still one driver, one kernel version, tried once, against an emulated card --
which is what the plan has always promised and is worth repeating next to a
working ping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

ldls/kpi/skb.c

@@ -0,0 +1,166 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Socket buffers. See ldls/kpi/kpi.h for the provenance rule.
+//
+// An `sk_buff` is the unit a Linux driver receives into and transmits from, so
+// a host that cannot make one cannot carry a packet. It is also the structure
+// with the most fields a driver touches directly, which is why every offset
+// here comes from BTF rather than from anything written down.
+//
+// The layout is worth one note because it is not what the names suggest:
+// `head` and `data` are pointers, but `tail` and `end` are **32-bit offsets
+// from head**, not pointers. Treating them as pointers produces something that
+// works for small packets on a lucky allocation and then does not.
+
+#include "types.h"
+#include "user.h"
+#include "posix.h"
+#include "kpi.h"
+
+// Room in front of the data for headers a stack might push. Linux reserves
+// this so that adding an Ethernet header does not mean copying the payload;
+// nothing here pushes anything, but a driver may rely on `skb_reserve` having
+// somewhere to go.
+#define KPI_HEADROOM 64
+
+static unsigned int
+rd32(void *base, unsigned int off)
+{
+  unsigned int v;
+  unsigned char *p = (unsigned char *)base + off;
+  int i;
+  for (i = 0; i < 4; i++) ((unsigned char *)&v)[i] = p[i];
+  return v;
+}
+
+static void
+wr32(void *base, unsigned int off, unsigned int v)
+{
+  unsigned char *p = (unsigned char *)base + off;
+  int i;
+  for (i = 0; i < 4; i++) p[i] = ((unsigned char *)&v)[i];
+}
+
+static void *
+rdptr(void *base, unsigned int off)
+{
+  void *v;
+  unsigned char *p = (unsigned char *)base + off;
+  int i;
+  for (i = 0; i < 8; i++) ((unsigned char *)&v)[i] = p[i];
+  return v;
+}
+
+static void
+wrptr(void *base, unsigned int off, void *v)
+{
+  unsigned char *p = (unsigned char *)base + off;
+  int i;
+  for (i = 0; i < 8; i++) p[i] = ((unsigned char *)&v)[i];
+}
+
+// One buffer: the control block, then headroom, then the frame.
+//
+// Allocated in one piece so that freeing is a no-op like every other
+// allocation here -- see the note in kpi.c about a hosted driver's lifetime.
+void *
+kpi_skb_alloc(unsigned int len)
+{
+  unsigned char *p;
+  unsigned int total = kpi_l.skb_size + KPI_HEADROOM + len + 64;
+  unsigned char *buf;
+
+  if (kpi_l.skb_size == 0)
+    return 0;
+
+  p = mmap(0, total, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  if (p == 0 || (long)p == -1)
+    return 0;
+
+  buf = p + kpi_l.skb_size;
+  wrptr(p, kpi_l.skb_head, buf);
+  wrptr(p, kpi_l.skb_data, buf + KPI_HEADROOM);
+  wr32(p, kpi_l.skb_tail, KPI_HEADROOM);
+  wr32(p, kpi_l.skb_end,  KPI_HEADROOM + len + 64);
+  wr32(p, kpi_l.skb_len,  0);
+  return p;
+}
+
+void *kpi_napi_alloc_skb(void *napi, unsigned int len)
+{ (void)napi; return kpi_skb_alloc(len); }
+
+void *kpi_netdev_alloc_skb(void *dev, unsigned int len)
+{ (void)dev; return kpi_skb_alloc(len); }
+
+// Claim `n` bytes at the tail and return where they start. The classic, and
+// the one every receive path is built on.
+void *
+kpi_skb_put(void *skb, unsigned int n)
+{
+  unsigned char *head = (unsigned char *)rdptr(skb, kpi_l.skb_head);
+  unsigned int   tail = rd32(skb, kpi_l.skb_tail);
+
+  wr32(skb, kpi_l.skb_tail, tail + n);
+  wr32(skb, kpi_l.skb_len, rd32(skb, kpi_l.skb_len) + n);
+  return head + tail;
+}
+
+void *
+kpi_skb_reserve(void *skb, int n)
+{
+  unsigned char *d = (unsigned char *)rdptr(skb, kpi_l.skb_data);
+  wrptr(skb, kpi_l.skb_data, d + n);
+  wr32(skb, kpi_l.skb_tail, rd32(skb, kpi_l.skb_tail) + (unsigned int)n);
+  return 0;
+}
+
+unsigned char *kpi_skb_data(void *skb) { return rdptr(skb, kpi_l.skb_data); }
+unsigned int   kpi_skb_len(void *skb)  { return rd32(skb, kpi_l.skb_len); }
+
+// Copy a frame out of an skb, which is what a driver does on transmit when it
+// cannot hand the buffer to the hardware directly. The checksum half of the
+// name does not apply: nothing here offloads one.
+void
+kpi_skb_copy_and_csum_dev(void *skb, unsigned char *to)
+{
+  unsigned char *d = rdptr(skb, kpi_l.skb_data);
+  unsigned int   n = rd32(skb, kpi_l.skb_len), i;
+  for (i = 0; i < n; i++)
+    to[i] = d[i];
+}
+
+// The driver has a frame. Hand it to the stack.
+//
+// "The stack" is the kernel on the other side of /dev/netdev, and this is the
+// point at which a packet that arrived on real hardware becomes an ordinary
+// frame on an ordinary interface. Everything before it is the driver's; nothing
+// after it knows a Linux driver was involved.
+int
+kpi_netif_receive_skb(void *skb)
+{
+  unsigned char *d = rdptr(skb, kpi_l.skb_data);
+  unsigned int   n = rd32(skb, kpi_l.skb_len);
+
+  if (kpi.netfd >= 0 && n > 0 && n <= 1536)
+    write(kpi.netfd, (char *)d, (int)n);
+  return 0;
+}
+
+// eth_type_trans(skb, dev) -- consume the Ethernet header and report the
+// protocol. The stack below wants the whole frame including that header, so
+// unlike Linux's this does not pull it off; what it returns is the type field,
+// which the driver passes on and nothing here reads.
+unsigned short
+kpi_eth_type_trans(void *skb, void *dev)
+{
+  unsigned char *d = rdptr(skb, kpi_l.skb_data);
+  unsigned int   n = rd32(skb, kpi_l.skb_len);
+
+  wrptr(skb, kpi_l.skb_dev, dev);
+  if (n < 14)
+    return 0;
+  return (unsigned short)((d[12] << 8) | d[13]);
+}
+
+void kpi_kfree_skb(void *skb) { (void)skb; }
+void kpi_kfree_skb_reason(void *skb, int r) { (void)skb; (void)r; }