Userspace device drivers #44

Summary

Move device drivers (keyboard, block, GPU) out of the kernel into userspace services, building on the service protocol framework (#26). Drivers would register as discoverable services (e.g., service:/keyboard) and clients would connect using typed protocols.

Current state

• All device drivers run in kernel space: virtio-keyboard, virtio-block, virtio-gpu
• Drivers directly access MMIO regions and handle interrupts in kernel context
• No mechanism to map device memory or deliver interrupts to userspace

Desired behaviour

Userspace drivers run as regular processes with special kernel-granted capabilities:

• MMIO mapping: Map PCI BAR regions into driver process address space
• Interrupt delivery: EVENT_IRQ posted to driver's mailbox when device interrupt fires
• DMA buffers: Allocate physically contiguous memory mapped into userspace with known physical addresses
• Device ownership: Exclusive access per PCI device (prevent multiple drivers claiming the same device)
• Service registration: Driver registers as service:/keyboard (or similar) for client discovery

Required kernel primitives

1. Userspace MMIO mapping: New syscall to map a PCI BAR into the calling process. Requires permission checks (only granted to driver processes).
2. Userspace interrupt delivery: When a device interrupt fires, the kernel posts an EVENT_IRQ to the owning driver's mailbox instead of calling a kernel handler. Uses the mailbox infrastructure from Service manager step 2: Timer resource (mailbox-integrated one-shot timers) #28.
3. DMA buffer allocation: Allocate physically contiguous pages and map them into userspace. Return both virtual and physical addresses. Needed for virtio descriptor rings and data buffers.
4. Device ownership: A registry tracking which process owns which PCI device. Prevents conflicts and ensures cleanup on process exit.
5. IOMMU support (for real hardware): Program the IOMMU to restrict DMA to allocated buffers only. Not needed for QEMU/virtio but essential for real hardware security.

Migration path

1. Implement kernel primitives (MMIO mapping, IRQ delivery, DMA allocation)
2. Port one simple driver first (keyboard) as proof of concept
3. Port block driver (more complex due to DMA)
4. Port GPU driver (most complex)
5. Remove in-kernel driver code once userspace versions are stable

Key files

• panda-kernel/src/drivers/ — current in-kernel drivers (to be replaced)
• panda-kernel/src/syscall/ — new syscalls for MMIO, IRQ, DMA
• panda-kernel/src/pci/ — device ownership tracking
• New userspace driver packages in userspace/drivers/

Testing

• Kernel test: MMIO mapping syscall maps correct physical range
• Kernel test: IRQ delivery posts event to mailbox
• Kernel test: DMA allocation returns physically contiguous memory
• Integration test: userspace keyboard driver receives key events
• Integration test: userspace block driver reads/writes correctly
• Run existing tests against userspace drivers to verify functional equivalence

Documentation

• Document each kernel primitive (MMIO, IRQ, DMA) syscall API
• Document the driver development guide (how to write a userspace driver)
• Document the migration plan and compatibility considerations
• Document IOMMU requirements for real hardware