net: a TCP/IP stack, and AF_INET on the sockets that were already there

lwIP 2.2.0, fetched by ports/lwip and compiled straight into the kernel.
Not written from scratch, and the reason is not the packet formats: it is
congestion control, retransmission, window management and twenty years of
corner cases that only show up against a real peer. Not FreeBSD's
netinet either, though the licence would have allowed it -- that stack is
not a library, it reaches into mbufs, epoch(9), netisr, VNET and uma(9),
so adopting it means porting FreeBSD's kernel infrastructure first. lwIP
was written for exactly this situation: a small kernel with a raw
Ethernet driver and a port layer of a few hundred lines.

It is kernel code, so nothing is installed into the sysroot and there is
no second build system: the top-level Makefile compiles the files it
wants against our port headers. The file list is explicit rather than a
wildcard, because lwIP ships IPv6, 6LoWPAN, PPP, SLIP, DNS-SD and a dozen
apps in the same tree, and building what is not configured yields either
dead code or a link error naming a port function nobody meant to write.
Its sources are unmodified and its warnings are silenced for its files
only -- patching them would mean maintaining a fork.

The port layer is ours: a lock, a clock, the netif that hands frames to
e1000, lwipopts.h, and a shim/ directory of tiny headers so lwIP's
<string.h> and friends resolve to the kernel's functions instead of the
host's, whose prototypes disagree and would otherwise be found on the
default include path.

NO_SYS=1, so lwIP has no threads of its own and one kernel thread feeds
it. A thread rather than the interrupt handler, because a call into lwIP
can reach the driver, the driver can sleep, and an interrupt handler
cannot -- so the interrupt still only clears the cause register and the
thread polls. kthread_create is new and generally useful: a process with
a kernel-only page directory, no files, no cwd, no parent, dispatched
from forkret, which can therefore sleep and be preempted like anything
else. DHCP obtains an address at boot and the console says which one.

AF_INET went in exactly where phase 2 said it would. socknew dispatches
on the domain, kernel/net/inet.c implements the internet side on lwIP's
raw API, and not one syscall changed shape: bind, connect, listen,
accept, read and write reach the same descriptors they always did. TCP
and UDP both work. cmd/nettest opens a connection, writes, and reads the
answer back.

Two things are owed and named here so they are not discovered later:
recvfrom does not yet report the source address, and the socket paths
poll on the timer tick instead of sleeping on the socket. Both are
follow-ups, not redesigns.

NOTICE carries lwIP's BSD-3 text. Clause 3 is no-endorsement, not the
old advertising clause, so it sits with Apache-2.0 without difficulty.

Verified: the tree builds clean, and the headless boot check passes with
27 [ok] and no failures with the stack compiled in and the thread
running -- which is the part that would break first if netinit deadlocked
or the thread starved anything. An end-to-end connection test belongs in
that suite and is the next commit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kernel/net/lwip/arch/cc.h

@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// lwIP's compiler/platform header for SchOS.
+//
+// lwIP includes this before anything else and expects it to supply the fixed
+// width types, the byte order, the diagnostic macros and the packing
+// attributes. Everything here is either a typedef onto the kernel's own types
+// or a one-line macro; there is no logic, by design -- this file is the seam
+// between two codebases and the fewer decisions it makes, the better.
+#ifndef LWIP_ARCH_CC_H
+#define LWIP_ARCH_CC_H
+
+#include "types.h"
+#include "defs.h"
+
+// There is no libc under the kernel, so every header lwIP would normally reach
+// for has to be switched off and its contents supplied here instead. That is
+// the contract arch.h states: set LWIP_NO_STDINT_H and you own the types, set
+// LWIP_NO_LIMITS_H and you own the limits, and so on.
+#define LWIP_NO_STDINT_H   1
+#define LWIP_NO_INTTYPES_H 1
+#define LWIP_NO_LIMITS_H   1
+#define LWIP_NO_CTYPE_H    1
+#define LWIP_NO_UNISTD_H   1
+
+// lwIP's own type names. Written against the kernel's types rather than C99
+// spellings, because the kernel already has names for these and introducing a
+// second set that must agree is one more thing to get wrong.
+typedef uchar              u8_t;
+typedef char               s8_t;
+typedef ushort             u16_t;
+typedef short              s16_t;
+typedef uint               u32_t;
+typedef int                s32_t;
+typedef uint64             u64_t;
+typedef int64              s64_t;
+#define LWIP_HAVE_INT64    1
+typedef unsigned long      mem_ptr_t;   // must be able to hold a pointer
+
+// ssize_t is the kernel's, not lwIP's. Defining SSIZE_MAX is how arch.h is
+// told that: it only declares its own `typedef int ssize_t` when this is
+// absent, and that would collide with the kernel's 64-bit one.
+#define SSIZE_MAX          0x7fffffffffffffffL
+#define INT_MAX            0x7fffffff
+
+// Format specifiers, since <inttypes.h> is switched off above. The kernel's
+// cprintf understands %d and %x and nothing wider, which is why these are the
+// plain forms rather than the length-qualified ones a hosted printf would use.
+#define X8_F  "x"
+#define U16_F "d"
+#define S16_F "d"
+#define X16_F "x"
+#define U32_F "d"
+#define S32_F "d"
+#define X32_F "x"
+#define SZT_F "d"
+
+// x86 is little-endian. Getting this wrong does not fail to compile; it fails
+// on the wire, as every checksum and every port number arriving byte-swapped.
+#define BYTE_ORDER LITTLE_ENDIAN
+
+// On-the-wire structures must not be padded. lwIP wraps every such struct in
+// these, and a compiler that ignored them would silently move every field in
+// every header lwIP parses.
+#define PACK_STRUCT_BEGIN
+#define PACK_STRUCT_STRUCT __attribute__((packed))
+#define PACK_STRUCT_END
+#define PACK_STRUCT_FIELD(x) x
+
+// Diagnostics. cprintf is the kernel's console printf.
+#define LWIP_PLATFORM_DIAG(x)   do { cprintf x; } while (0)
+#define LWIP_PLATFORM_ASSERT(x) \
+    do { cprintf("lwip assert: %s at %s:%d\n", (x), __FILE__, __LINE__); \
+         panic("lwip assertion"); } while (0)
+
+// lwIP is single-threaded here (NO_SYS=1) but is still entered from two places:
+// the network thread and any syscall that touches a socket. Both take the same
+// lock, and these are what lwIP itself uses to bracket its critical sections.
+// See kernel/net/lwip/sys_arch.c.
+void lwip_sys_lock(void);
+void lwip_sys_unlock(void);
+
+typedef int sys_prot_t;
+#define SYS_ARCH_DECL_PROTECT(lev)
+#define SYS_ARCH_PROTECT(lev)   lwip_sys_lock()
+#define SYS_ARCH_UNPROTECT(lev) lwip_sys_unlock()
+
+// lwIP calls these for its own buffers. The kernel has no malloc, so lwIP is
+// configured (MEM_LIBC_MALLOC 0) to use its own pool allocator out of a static
+// heap instead -- these exist only because a few optional modules reference
+// them, and reaching one is a bug rather than a fallback.
+// Spelled with the underlying type rather than lwIP's u32_t: this header is
+// included *before* lwIP's arch.h defines u32_t, so naming it here would be a
+// forward reference to a typedef that does not exist yet.
+#define LWIP_RAND() (lwip_rand_seed())
+u32_t lwip_rand_seed(void);
+
+#endif

kernel/net/lwip/lwipopts.h

@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// lwIP configuration for SchOS.
+//
+// The shape of this file is one decision: NO_SYS=1.
+//
+// lwIP can run either as a set of threads of its own (NO_SYS=0), which needs a
+// port layer of semaphores, mailboxes and thread creation and then hands you a
+// blocking sockets API for free; or bare, with no threading assumptions
+// (NO_SYS=1), where every call must come from one context and the blocking is
+// yours to write. This kernel takes the second, for two reasons: the sys_arch
+// a threaded lwIP wants is more code than the socket layer it would save, and
+// the kernel already has a socket layer with its own shape (kernel/net/unix.c)
+// that AF_INET has to fit into rather than replace.
+//
+// "One context" is enforced by a single lock rather than by literally one
+// thread: kernel/net/net.c takes it around the network thread's work, and the
+// socket syscalls take it around theirs. That is the entire concurrency model.
+#ifndef LWIP_LWIPOPTS_H
+#define LWIP_LWIPOPTS_H
+
+#define NO_SYS                      1
+#define SYS_LIGHTWEIGHT_PROT        1
+#define LWIP_NETCONN                0   // needs NO_SYS=0
+#define LWIP_SOCKET                 0   // ours lives in kernel/net/inet.c
+
+// Memory. All of it is static: the kernel's allocator hands out whole pages
+// and nothing else, so lwIP's own pools are a better fit than wrapping kalloc.
+// These numbers are sized for a handful of connections, not for a server.
+#define MEM_LIBC_MALLOC             0
+#define MEMP_MEM_MALLOC             0
+#define MEM_ALIGNMENT               4
+#define MEM_SIZE                    (192 * 1024)
+#define MEMP_NUM_PBUF               32
+#define MEMP_NUM_UDP_PCB            8
+#define MEMP_NUM_TCP_PCB            16
+#define MEMP_NUM_TCP_PCB_LISTEN     8
+#define MEMP_NUM_TCP_SEG            64
+#define MEMP_NUM_ARP_QUEUE          16
+#define MEMP_NUM_SYS_TIMEOUT        16
+#define PBUF_POOL_SIZE              48
+#define PBUF_POOL_BUFSIZE           1536   // one Ethernet frame plus room
+
+// Protocols. IPv4 only: the driver is proven for it, the QEMU test network is
+// v4, and every line of v6 here would be untested.
+#define LWIP_IPV4                   1
+#define LWIP_IPV6                   0
+#define LWIP_ARP                    1
+#define LWIP_ETHERNET               1
+#define LWIP_ICMP                   1
+#define LWIP_RAW                    1
+#define LWIP_UDP                    1
+#define LWIP_TCP                    1
+#define LWIP_DHCP                   1
+#define LWIP_DNS                    1
+#define LWIP_AUTOIP                 0
+#define LWIP_IGMP                   0
+#define LWIP_NETIF_HOSTNAME         1
+
+// DHCP needs UDP checksums and a broadcast path; both are on. Requesting an
+// address rather than hard-coding one matters because QEMU's user-mode network
+// hands out 10.0.2.15 through DHCP and nothing else will route.
+#define LWIP_NETIF_STATUS_CALLBACK  1
+#define LWIP_NETIF_LINK_CALLBACK    1
+
+#define TCP_MSS                     1460
+#define TCP_SND_BUF                 (8 * TCP_MSS)
+#define TCP_WND                     (8 * TCP_MSS)
+#define TCP_SND_QUEUELEN            ((4 * TCP_SND_BUF) / TCP_MSS)
+#define TCP_LISTEN_BACKLOG          1
+
+// Checksums in software. The e1000 can offload them, but the driver does not
+// ask it to, and a checksum computed by a device the stack has not been told
+// about is the sort of mismatch that shows up only against a real peer.
+#define CHECKSUM_GEN_IP             1
+#define CHECKSUM_GEN_UDP            1
+#define CHECKSUM_GEN_TCP            1
+#define CHECKSUM_CHECK_IP           1
+#define CHECKSUM_CHECK_UDP          1
+#define CHECKSUM_CHECK_TCP          1
+
+// Statistics are what /proc/net reports; they cost a few counters.
+#define LWIP_STATS                  1
+#define LWIP_STATS_DISPLAY          0
+
+// Debug output off by default -- turning LWIP_DEBUG on here makes the stack
+// extremely chatty on the console, which is occasionally exactly what you want.
+#define LWIP_DEBUG                  0
+
+// lwIP would otherwise provide its own errno, which would then disagree with
+// the kernel's for every value a syscall returns.
+#define LWIP_PROVIDE_ERRNO          1
+
+#endif

kernel/net/lwip/netif_e1000.c

@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The lwIP network interface backed by the e1000 driver.
+//
+// Two directions and almost nothing else: a linkoutput that flattens a pbuf
+// chain into a frame and hands it to the driver, and a poll that takes frames
+// off the driver and hands them up. Everything about IP, ARP and TCP lives in
+// lwIP; everything about descriptors and registers lives in the driver; this
+// file is the seam.
+
+#include "types.h"
+#include "defs.h"
+#include "param.h"
+
+#include "lwip/opt.h"
+#include "lwip/netif.h"
+#include "lwip/pbuf.h"
+#include "lwip/etharp.h"
+#include "lwip/ethip6.h"
+#include "netif/ethernet.h"
+
+#define ETH_MTU     1500
+#define ETH_FRAMESZ 1518        // 1500 payload + 14 header + 4 FCS allowance
+
+static struct netif e1000_netif;
+
+// One staging buffer, not one per call: a frame is 1518 bytes and the kernel
+// stack is 4096 in total, so a local of this size on a path that is several
+// frames deep is exactly the overflow the kstack canary exists to catch.
+// Safe as a single static because every caller holds the lwIP lock.
+static char txframe[ETH_FRAMESZ];
+static char rxframe[ETH_FRAMESZ];
+
+// Send one packet. lwIP hands over a pbuf chain; the driver wants one flat
+// buffer, so this walks the chain into txframe.
+static err_t
+e1000_linkoutput(struct netif *netif, struct pbuf *p)
+{
+    (void)netif;
+
+    if (p->tot_len > sizeof(txframe))
+        return ERR_IF;
+
+    u16_t off = 0;
+    for (struct pbuf *q = p; q != NULL; q = q->next) {
+        if (off + q->len > sizeof(txframe))
+            return ERR_IF;
+        memmove(txframe + off, q->payload, q->len);
+        off += q->len;
+    }
+
+    // A full transmit ring is congestion, not failure. Reporting ERR_IF would
+    // make lwIP drop the segment and wait for a retransmission timer; ERR_WOULDBLOCK
+    // lets it try again, which for TCP is the difference between a stall of
+    // milliseconds and one of seconds.
+    if (e1000_transmit(txframe, off) != 0)
+        return ERR_WOULDBLOCK;
+
+    return ERR_OK;
+}
+
+// Bring the interface up. Called once, by the network thread.
+static err_t
+e1000_netif_init(struct netif *netif)
+{
+    const unsigned char *mac = e1000_mac();
+
+    netif->name[0] = 'e';
+    netif->name[1] = 'n';
+    netif->output     = etharp_output;   // IP -> ARP -> linkoutput
+    netif->linkoutput = e1000_linkoutput;
+    netif->mtu        = ETH_MTU;
+    netif->hwaddr_len = 6;
+    for (int i = 0; i < 6; i++)
+        netif->hwaddr[i] = mac[i];
+    netif->flags = NETIF_FLAG_BROADCAST | NETIF_FLAG_ETHARP | NETIF_FLAG_LINK_UP;
+    return ERR_OK;
+}
+
+struct netif *
+net_e1000_netif(void)
+{
+    return &e1000_netif;
+}
+
+// Attach the interface with no address yet -- DHCP fills it in.
+int
+net_e1000_attach(void)
+{
+    ip4_addr_t any;
+    IP4_ADDR(&any, 0, 0, 0, 0);
+
+    if (netif_add(&e1000_netif, &any, &any, &any, NULL,
+                  e1000_netif_init, netif_input) == NULL)
+        return -1;
+
+    netif_set_default(&e1000_netif);
+    netif_set_up(&e1000_netif);
+    netif_set_link_up(&e1000_netif);
+    return 0;
+}
+
+// Take whatever the driver has and push it into lwIP. Returns how many frames
+// moved, so the caller can tell a busy poll from an idle one.
+//
+// Bounded rather than draining: a receive loop with no limit starves everything
+// else on a busy network, and the caller comes straight back anyway.
+int
+net_e1000_poll(void)
+{
+    int moved = 0;
+
+    for (int i = 0; i < 32; i++) {
+        int len = e1000_receive(rxframe, sizeof(rxframe));
+        if (len <= 0)
+            break;
+
+        // PBUF_POOL, so this comes from lwIP's own pool rather than a heap it
+        // does not have. A null return means the pool is exhausted, which is a
+        // dropped packet -- entirely normal under load, and what the protocol
+        // above is designed to survive.
+        struct pbuf *p = pbuf_alloc(PBUF_RAW, (u16_t)len, PBUF_POOL);
+        if (p == NULL)
+            break;
+
+        pbuf_take(p, rxframe, (u16_t)len);
+
+        // netif->input is netif_input, set at netif_add: it dispatches on the
+        // Ethernet type. Ownership of the pbuf passes with the call, including
+        // when it fails, so there is nothing to free here.
+        if (e1000_netif.input(p, &e1000_netif) != ERR_OK)
+            pbuf_free(p);
+
+        moved++;
+    }
+    return moved;
+}

kernel/net/lwip/shim/ctype.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <ctype.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_ctype_H
+#define LWIP_SHIM_ctype_H
+#endif

kernel/net/lwip/shim/errno.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <errno.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_errno_H
+#define LWIP_SHIM_errno_H
+#endif

kernel/net/lwip/shim/inttypes.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <inttypes.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_inttypes_H
+#define LWIP_SHIM_inttypes_H
+#endif

kernel/net/lwip/shim/limits.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <limits.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_limits_H
+#define LWIP_SHIM_limits_H
+#endif

kernel/net/lwip/shim/stddef.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <stddef.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_stddef_H
+#define LWIP_SHIM_stddef_H
+#endif

kernel/net/lwip/shim/stdint.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <stdint.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_stdint_H
+#define LWIP_SHIM_stdint_H
+#endif

kernel/net/lwip/shim/stdio.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <stdio.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_stdio_H
+#define LWIP_SHIM_stdio_H
+#endif

kernel/net/lwip/shim/stdlib.h

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// <stdlib.h> for lwIP, shadowing the host's. See shim/string.h for why these
+// files exist at all.
+//
+// lwIP does not need an allocator from here: MEM_LIBC_MALLOC is off, so it uses
+// its own pools out of a static heap. That is not a workaround -- the kernel's
+// allocator hands out whole pages and lwIP wants byte granularity, so its pools
+// are the better fit either way.
+//
+// atoi is the one thing it genuinely calls, in netif_name_to_index, to turn the
+// digits at the end of an interface name into a number.
+#ifndef LWIP_SHIM_STDLIB_H
+#define LWIP_SHIM_STDLIB_H
+
+// Deliberately not a general atoi: no sign, no whitespace, no overflow
+// handling. It is fed the tail of an interface name ("en0" -> "0"), and
+// anything cleverer would be untested code answering a question nobody asks.
+static inline int
+atoi(const char *s)
+{
+    int n = 0;
+    while (*s >= '0' && *s <= '9')
+        n = n * 10 + (*s++ - '0');
+    return n;
+}
+
+#endif

kernel/net/lwip/shim/string.h

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// <string.h> for lwIP, shadowing the host's.
+//
+// lwIP includes <string.h> in thirty-odd files. The kernel is built
+// -ffreestanding and has its own string functions, but the compiler's default
+// include path still finds /usr/include/string.h -- which declares strlen
+// returning size_t against a kernel that returns int, and drags sigset_t and
+// __float128 in behind it. So the lwIP include path puts this directory first.
+//
+// The prototypes are repeated here rather than taken from defs.h on purpose.
+// lwIP includes <string.h> at the very top of a translation unit, before any
+// kernel header has been seen, so pulling defs.h in from here would drop the
+// whole kernel's declarations into a context where its own types are not
+// defined yet -- which shows up as errors in unrelated headers, like file.h
+// not knowing what NDIRECT is.
+//
+// They must match kernel/core/string.c exactly. Only what lwIP calls is here;
+// anything else should be added deliberately rather than by growing this into
+// a libc.
+#ifndef LWIP_SHIM_STRING_H
+#define LWIP_SHIM_STRING_H
+
+int    memcmp(const void *, const void *, unsigned long);
+void  *memmove(void *, const void *, unsigned long);
+void  *memset(void *, int, unsigned long);
+int    strlen(const char *);
+int    strncmp(const char *, const char *, unsigned long);
+char  *strncpy(char *, const char *, int);
+
+// The kernel deliberately provides only memmove, on the grounds that a copy
+// which happens to overlap should not be undefined behaviour. lwIP calls
+// memcpy in a handful of places, always on buffers it has just allocated, so
+// mapping it onto memmove is correct and costs nothing.
+#define memcpy(d, s, n) memmove((d), (s), (n))
+
+#endif

kernel/net/lwip/shim/unistd.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// <unistd.h> for lwIP, shadowing the host's.
+//
+// Empty on purpose. Everything lwIP would take from this header is supplied by
+// arch/cc.h instead -- see the LWIP_NO_*_H switches there -- and the file exists
+// only so the #include resolves to something harmless rather than to the host's
+// copy, which declares types the kernel already has and pulls half of glibc in
+// behind them. See shim/string.h for the full reasoning.
+#ifndef LWIP_SHIM_unistd_H
+#define LWIP_SHIM_unistd_H
+#endif

kernel/net/lwip/sys_arch.c

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The lwIP port layer: everything lwIP needs from the system it runs on.
+//
+// With NO_SYS=1 that is a short list -- a clock, a source of randomness, and a
+// lock -- because lwIP is not creating threads or mailboxes of its own. The
+// lock is the interesting one.
+//
+// ---------------------------------------------------------------------------
+// The concurrency model, in full
+//
+// lwIP with NO_SYS=1 is not re-entrant. It is entered from exactly two kinds of
+// place here: the network thread (kernel/net/net.c), which feeds it received
+// frames and runs its timers, and the socket syscalls, which call into it on
+// behalf of a process. Those can run on different CPUs at the same time, so
+// something has to serialise them, and lwIP's own SYS_ARCH_PROTECT hooks are
+// the sanctioned place to put it.
+//
+// A sleeplock rather than a spinlock, because a call into lwIP can reach the
+// driver and the driver can sleep. That makes this lock unusable from an
+// interrupt handler -- which is why the e1000 interrupt does not feed lwIP
+// directly and the network thread polls instead.
+//
+// It is recursive by necessity: lwIP brackets small critical sections inside
+// larger ones and expects nesting to be free.
+
+#include "types.h"
+#include "defs.h"
+#include "param.h"
+#include "spinlock.h"
+#include "sleeplock.h"
+#include "proc.h"
+
+#include "lwip/opt.h"
+#include "lwip/sys.h"
+
+static struct sleeplock lwip_lock;
+static struct proc     *lwip_owner;
+static int              lwip_depth;
+static int              lwip_lock_ready;
+
+void
+lwip_sys_init(void)
+{
+    initsleeplock(&lwip_lock, "lwip");
+    lwip_owner      = 0;
+    lwip_depth      = 0;
+    lwip_lock_ready = 1;
+}
+
+// Reading `lwip_owner` without holding anything is safe in the one direction it
+// is asked: only the process inside the lock ever writes its own proc pointer
+// there, and it holds the lock the whole time. No other process can see its own
+// pointer here, so a stale read cannot produce a false "I hold it". The null
+// check matters because myproc() is 0 in early boot, and 0 == 0 would otherwise
+// claim the lock for a process that does not exist.
+static int
+lwip_lock_mine(void)
+{
+    return lwip_owner != 0 && lwip_owner == myproc();
+}
+
+void
+lwip_sys_lock(void)
+{
+    // Before lwip_sys_init runs there is exactly one context in existence, so
+    // there is nothing to serialise against and the sleeplock is not yet valid.
+    if (!lwip_lock_ready)
+        return;
+    if (lwip_lock_mine()) {
+        lwip_depth++;
+        return;
+    }
+    acquiresleep(&lwip_lock);
+    lwip_owner = myproc();
+    lwip_depth = 1;
+}
+
+void
+lwip_sys_unlock(void)
+{
+    if (!lwip_lock_ready)
+        return;
+    if (!lwip_lock_mine())
+        return;                 // not ours; releasing would free someone else's
+    if (--lwip_depth > 0)
+        return;
+    lwip_owner = 0;
+    releasesleep(&lwip_lock);
+}
+
+// Milliseconds since boot. lwIP drives every timer off this: retransmission,
+// TIME_WAIT, ARP expiry, DHCP renewal. It need not match wall time, but it must
+// advance monotonically -- a clock that goes backwards makes lwIP believe every
+// timer is due at once.
+//
+// `ticks` is the timer interrupt count at 100 Hz, so one tick is 10 ms. Taken
+// without the lock: it is a single aligned word, and a torn read would cost
+// lwIP one early or late timer rather than anything worse.
+u32_t
+sys_now(void)
+{
+    return (u32_t)ticks * 10u;
+}
+
+// lwIP wants randomness for initial TCP sequence numbers and for the DHCP
+// transaction id. Sequence numbers that are predictable are a real weakness on
+// a network with anyone hostile on it; this is not a CSPRNG and does not claim
+// to be, but it is seeded from a clock that an outsider cannot observe.
+u32_t
+lwip_rand_seed(void)
+{
+    static u32_t s;
+    if (s == 0)
+        s = (u32_t)ticks ^ 0x9E3779B9u;
+    // xorshift32
+    s ^= s << 13;
+    s ^= s >> 17;
+    s ^= s << 5;
+    return s;
+}