ldls: a second driver, and everything it found

e1000 -- Linux's, unmodified -- probes, opens, gets an address by DHCP and
carries ping traffic in a SchOS process. The kernel was driving that NIC and
gave it up, which makes it the first real handover as well as the second
driver.

None of what it needed was a missing feature. Every one was a call that
succeeded, returned zero and did nothing:

  _find_next_bit          "bit 0 is set"          -- for_each_cpu never ended
  netif_carrier_off       carrier already up      -- TCTL.EN never set
  __x86_indirect_thunk_r8 the jump discarded      -- 255 rx buffers, none made
  dma_map_page_attrs      bus address 0           -- NIC aimed at physical 0

so the rule from memcpy is now general: a stub returning zero is unsafe
wherever zero is a meaningful answer.

The loader grew ko_fixup_percpu(). The stack guard turned out to be one
per-CPU variable among several; `current` cannot be defused because the driver
dereferences it. Taking the %gs off instead leaves the same opcode reading the
same width from storage the host supplies -- a per-CPU variable in a
single-threaded host is just a variable. Eight bytes become seven and a nop,
and the displacement is not always last, so there is now just enough of an x86
decoder in ko.c to know how long the instruction is.

ldls/kpi/thunk.c is fifteen lines of assembly and the highest-value file here:
retpolines are control flow, and a stub cannot stand in for a jump.

The kernel side:

  - ioperm.c, the TSS I/O permission bitmap. A driver's outl is an instruction,
    not a call, and e1000's reset path picks it deliberately. IOPL=3 would hand
    over the PIC and the disk with it, so it is per-port. Writing it found that
    the I/O map base had been written at offset 64 rather than 102, leaving the
    CPU checking ports 0-831 against the TSS's own RSP0.
  - claim masks the device's IRQ line: 450,000 a second, otherwise.
  - net_detach(), the missing half of net_attach_late(). An interface left in
    the stack keeps its route and sends every frame to a driver that refuses
    it, which looks exactly like a userspace driver that does not work.
  - e1000_release() gives up the interface, not just the hardware.

8139too still passes 4/4; ldls-check still passes 27; four CPUs, no panic.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/dev/pciuser.c

@@ -24,6 +24,7 @@
 #include "memlayout.h"
 #include "mmu.h"
 #include "proc.h"
+#include "ioperm.h"
 #include "pci.h"
 #include "errno.h"
 #include "uaccess.h"
@@ -342,6 +343,10 @@ pciuser_release_all(struct proc *p)
       pciuser_stop(i);
   }
 
+  // And its ports. The bitmap itself is closed by the next switchuvm() on each
+  // CPU; see ioperm_revoke_all().
+  ioperm_revoke_all(p);
+
   acquire(&pciuser_lock);
 
   // And its interrupt line -- unregistered, and left MASKED.
@@ -485,6 +490,56 @@ do_claim(uint64 argp)
   // it back. The two are a pair, and the second driver to run is the one that
   // finds out if they are not.
   pci_enable((struct pci_dev *)d, PCI_CMD_MEMORY | PCI_CMD_BUS_MASTER);
+
+  // And its interrupt line: masked.
+  //
+  // The kernel driver that just let go had a handler on this line and no
+  // longer does, but the device is about to be brought up by a driver in a
+  // process and *will* assert it. With nothing to acknowledge the cause at the
+  // device, every EOI re-enters an empty dispatch immediately:
+  //
+  //   irq 11: 449905 interrupts/second -- a device on this line is not
+  //           acknowledging it.
+  //
+  // which is the machine spending all of its time noticing. The line comes
+  // back when the process asks for it with PCIIOC_IRQ, which is the same
+  // arrangement pciuser_release_all() leaves behind and for the same reason.
+  if (d->irq != 0xFF && d->irq < 24) {
+    ioapicmask(d->irq);
+    acquire(&pciuser_lock);
+    if (irqdev.proc == 0)
+      irqdev.masked = 1;
+    release(&pciuser_lock);
+  }
+
+  // And the ports, if it has any.
+  //
+  // A Linux driver does not always go through a function we can intercept:
+  // e1000's reset path issues `out` directly, because on an 82540 that is the
+  // only way the chip will acknowledge the write. So a process holding a
+  // device gets that device's I/O BARs and nothing else -- see
+  // include/ioperm.h. PCI_CMD_IO goes with them for the same reason memory
+  // space goes with the mapping above.
+  {
+    int granted = 0;
+    for (int b = 0; b < PCIUSER_MAXBAR; b++) {
+      if (!d->bar[b].is_io || !d->bar[b].base || !d->bar[b].size)
+        continue;
+      if (d->bar[b].base > 0xffff || d->bar[b].base + d->bar[b].size > 0x10000)
+        continue;               // above the port space; nothing to grant
+      ioperm_grant(myproc(), (uint16)d->bar[b].base, (uint16)d->bar[b].size);
+      granted = 1;
+    }
+    if (granted) {
+      pci_enable((struct pci_dev *)d, PCI_CMD_IO);
+      // Install them on this CPU now, rather than at the next switchuvm().
+      // The process asked for them in a system call and returns to user mode
+      // from here, which need not go through the scheduler at all.
+      pushcli();
+      ioperm_switch(myproc());
+      popcli();
+    }
+  }
   return 0;
 }
 
@@ -507,8 +562,17 @@ do_release(uint64 argp)
   // politely has usually quiesced its device already, but "usually" is not a
   // property the kernel can check, and the cost of being sure is one config
   // write.
-  if (mine)
+  if (mine) {
     pciuser_stop(idx);
+    // Ports go back too. Coarse on purpose: this drops *every* range the
+    // process had rather than only this device's, and the next claim puts
+    // them back. A process releasing one of several devices is not a case
+    // that exists yet, and a revoke that is too wide fails safe.
+    ioperm_revoke_all(myproc());
+    pushcli();
+    ioperm_switch(myproc());
+    popcli();
+  }
   return 0;
 }