ldls: a second driver, and everything it found

e1000 -- Linux's, unmodified -- probes, opens, gets an address by DHCP and
carries ping traffic in a SchOS process. The kernel was driving that NIC and
gave it up, which makes it the first real handover as well as the second
driver.

None of what it needed was a missing feature. Every one was a call that
succeeded, returned zero and did nothing:

  _find_next_bit          "bit 0 is set"          -- for_each_cpu never ended
  netif_carrier_off       carrier already up      -- TCTL.EN never set
  __x86_indirect_thunk_r8 the jump discarded      -- 255 rx buffers, none made
  dma_map_page_attrs      bus address 0           -- NIC aimed at physical 0

so the rule from memcpy is now general: a stub returning zero is unsafe
wherever zero is a meaningful answer.

The loader grew ko_fixup_percpu(). The stack guard turned out to be one
per-CPU variable among several; `current` cannot be defused because the driver
dereferences it. Taking the %gs off instead leaves the same opcode reading the
same width from storage the host supplies -- a per-CPU variable in a
single-threaded host is just a variable. Eight bytes become seven and a nop,
and the displacement is not always last, so there is now just enough of an x86
decoder in ko.c to know how long the instruction is.

ldls/kpi/thunk.c is fifteen lines of assembly and the highest-value file here:
retpolines are control flow, and a stub cannot stand in for a jump.

The kernel side:

  - ioperm.c, the TSS I/O permission bitmap. A driver's outl is an instruction,
    not a call, and e1000's reset path picks it deliberately. IOPL=3 would hand
    over the PIC and the disk with it, so it is per-port. Writing it found that
    the I/O map base had been written at offset 64 rather than 102, leaving the
    CPU checking ports 0-831 against the TSS's own RSP0.
  - claim masks the device's IRQ line: 450,000 a second, otherwise.
  - net_detach(), the missing half of net_attach_late(). An interface left in
    the stack keeps its route and sends every frame to a driver that refuses
    it, which looks exactly like a userspace driver that does not work.
  - e1000_release() gives up the interface, not just the hardware.

8139too still passes 4/4; ldls-check still passes 27; four CPUs, no panic.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/drivers/net/e1000/e1000.c

@@ -49,6 +49,11 @@ struct e1000 {
   // the two calls are separate, and nothing else connects them.
   struct pci_dev *pdev;
 
+  // And the network device the stack knows it by, so that letting go of the
+  // hardware can also take the interface out of the stack. Set by attached(),
+  // which is where the two are first introduced.
+  struct device *ndev;
+
   struct spinlock lock;
 };
 
@@ -387,6 +392,62 @@ e1000_link_up(struct device *dev)
   return e && e->ready && (rd(e, E1000_STATUS) & E1000_STATUS_LU) != 0;
 }
 
+// Let go of the device, so a userspace driver can have it.
+//
+// The same hook virtio-gpu grew for H1, on a NIC. docs/plan/hybrid.md's rule
+// is that the kernel keeps a minimal driver for everything on the path to a
+// shell -- and a network interface is not on that path, so this one may leave.
+//
+// "Letting go" is more than saying yes. The device is still bus-mastering into
+// descriptor rings this driver allocated, and the process about to claim it
+// will be handed those pages back by the arena. So the receiver and the
+// transmitter are switched off and the interrupt is masked *at the device*
+// before the handler is unregistered: masking after unregistering leaves a
+// window where a level-triggered line is asserted with nobody to clear it,
+// which is the failure docs/history/kernel.md section 13 is about.
+//
+// `ready` going false is what makes the class vtable safe afterwards --
+// transmit, receive and link_up all check it, so the stack sees an interface
+// whose link is down rather than one that swallows packets.
+static int
+e1000_release(struct pci_dev *d)
+{
+  struct e1000 *e = 0;
+
+  // Found by the device it is bound to. struct pci_dev carries no private
+  // pointer -- this driver keeps its instances in a table and matches on
+  // `pdev`, the same way e1000_attached() does.
+  for (int i = 0; i < E1000_MAX_NICS; i++)
+    if (nics[i].pdev == d) { e = &nics[i]; break; }
+
+  if (!e || !e->ready)
+    return 0;                     // never came up, or already let go
+
+  e->ready = 0;
+
+  wr(e, E1000_IMC, 0xFFFFFFFF);            // no more interrupts from it
+  wr(e, E1000_RCTL, 0);                    // stop receiving
+  wr(e, E1000_TCTL, 0);                    // stop transmitting
+  rd(e, E1000_STATUS);                     // post the writes
+
+  if (d->irq != 0xFF)
+    irq_unregister(d->irq, e1000_intr, e);
+
+  // And take the interface out of the stack.
+  //
+  // Leaving it there is worse than it sounds. The netif keeps its address and
+  // the route to its subnet, so the stack goes on choosing it -- and every
+  // frame it sends reaches e1000_transmit, which now correctly refuses. The
+  // packets stop and nothing reports an error, which is indistinguishable
+  // from a driver in a process that does not work. It was mistaken for
+  // exactly that for an afternoon.
+  if (e->ndev)
+    net_detach(e->ndev);
+
+  cprintf("e1000: released to userspace; the interface is down\n");
+  return 0;
+}
+
 // Hang the instance on the device the bus has just published. See the comment
 // on `attached` in include/pci.h for why this cannot happen inside probe().
 static void
@@ -395,6 +456,7 @@ e1000_attached(struct pci_dev *d, struct device *dev)
   for (int i = 0; i < E1000_MAX_NICS; i++)
     if (nics[i].ready && nics[i].pdev == d) {
       dev->priv = &nics[i];
+      nics[i].ndev = dev;
       return;
     }
 }
@@ -414,4 +476,5 @@ const struct pci_driver e1000_driver = {
   .ops   = &e1000_netdev_ops,
   .probe = e1000_probe,
   .attached = e1000_attached,
+  .release = e1000_release,
 };