net: a network *class*, so the stack stops knowing what an e1000 is

The TCP/IP stack reached straight into the first driver anyone wrote.
net.c called e1000_present(), the lwIP glue was named netif_e1000.c and
called e1000_transmit(), and include/defs.h declared the driver's
internals to the whole kernel. The second NIC driver would therefore
have arrived with a near-identical copy of the glue file and a patch to
the protocol stack, which is the arrangement include/device.h was
written to prevent -- the e1000 even said so, with `.ops = 0, // no
class vtable yet; there is no net class`.

There is now. A driver publishes a struct netdev_ops -- transmit,
receive, mac, link_up -- and is finished: it never mentions lwIP, and
nothing above it learns its name. The display class was already this
shape; this is the same shape for networking, and the two now read the
same way in kernel/dev/device.c.

What that made possible immediately:

  - One netif per bound device instead of one per driver. lwIP's glue is
    netif_eth.c, it takes a struct device, and it holds up to NETIF_MAX
    interfaces. net.c attaches every network device it finds and starts
    DHCP on each, because which interface the network answers on is not
    ours to decide.
  - /proc/netif lists all of them, one block of fields each, with the
    interface name and the driver that claimed it.
  - The ARP self-test moved from the e1000 to the class. Nothing in it
    was chip-specific, and it is the first thing anyone will want to run
    against the next driver. Still `echo n > /proc/sysrq`.
  - Private headers live with their driver: e1000.h was in include/,
    where exactly one file could use it. The driver build now adds the
    driver's own directory to the include path.

The e1000 also drives more than one card. Its probe() refused the second
outright, because there was a single static instance -- so a machine
with two of them drove one and silently ignored the other. Instances are
an array now, and the instance is hung on dev->priv by a new optional
`attached` hook that the bus calls once the device exists. probe() runs
before device_add(), so there was previously nowhere to put it; that is
the whole reason the hook exists rather than a line inside probe.

QEMU gets an explicit NIC on every target (QEMU_NET). The default device
happens to be an e1000 on this machine type today, which is exactly the
sort of thing that stays true until a QEMU release changes it and the
network stops being exercised without anyone noticing.

Verified:
  - bootcheck -Net passes, 48 [ok], no failures -- including the moved
    self-test and two new checks that /proc/netif names both the
    interface and the driver behind it, which together say the stack
    went through the class rather than through a driver it was compiled
    to know.
  - Two NICs attached by hand (-device e1000 twice, second with its own
    MAC): eth0 and eth1 both attach, each reports its own MAC in
    /proc/netif, and each gets its own DHCP lease. Before this commit
    the same machine produced one interface.
  - make schfs-check still passes in full.

One trap worth recording: moving a header broke the build for anyone
with stale .d files -- make stopped with "No rule to make target
'include/e1000.h'". CFLAGS gains -MP, which emits a phony target per
header so a moved or deleted one can never wedge the build again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/drivers.md

@@ -116,11 +116,36 @@ existing mechanisms for keeping that true mechanically rather than by intention.
 
 2. Declare it in `kernel/drivers/registry.c` and add it to the array.
 3. Add the object to `KERN_DRIVERS` in the `Makefile`.
+4. Fill in the **class vtable** for what it is, and point `.ops` at it. That is
+   the whole of what the rest of the kernel sees:
+
+   | class | vtable | consumer |
+   |---|---|---|
+   | `DEVCLASS_DISPLAY` | `struct display_ops` ([display.h](../include/display.h)) | the compositor, the console |
+   | `DEVCLASS_NET` | `struct netdev_ops` ([netdev.h](../include/netdev.h)) | the TCP/IP stack |
+
+   A driver that fills these in never mentions its consumer, and its consumer
+   never mentions it. Getting this wrong has a characteristic shape: the e1000
+   shipped with `.ops = 0` and the network stack called `e1000_transmit()`
+   directly, so `kernel/net/` was full of one driver's name and the second NIC
+   driver would have had to edit the protocol stack to add itself.
+
+Private headers go **next to the driver**, not in `include/`. The build adds
+the driver's own directory to the include path, so `e1000.h` — a register map
+that exactly one file has any use for — lives in `kernel/drivers/net/e1000/`.
+`include/` is for headers the rest of the kernel needs.
 
 Registration in the device model is automatic — `pci_bind()` and
 `usb_bind_all()` publish whatever they claim, so a driver cannot forget to. Set
 `devclass` on a USB driver, or the device lands in `other`.
 
+A driver that can drive **more than one card at once** keeps its instances in
+an array and implements `.attached`, which the bus calls once the `struct
+device` exists; hang the instance on `dev->priv` there and read it back in
+every op. It cannot be done inside `probe()`, because the device is published
+afterwards. Skipping this is how a driver ends up refusing the second card, as
+the e1000 did until it was asked to drive two.
+
 The best source for a new driver is the **specification**, not another kernel:
 xHCI, AHCI, virtio, NVMe and the Intel datasheets are public documents with no
 licence on what you write from them. `kernel/drivers/bus/xhci/xhci.c` came from the spec, and so did

docs/roadmap.md

@@ -167,9 +167,21 @@ TCP/IP, so they are the right thing to build the socket layer's shape around.
       to them, and both ends are asserted -- one side alone cannot tell a
       working stack from one that completes a handshake and drops every byte.
       45 [ok] with it on.
+- [x] The **netdev class**, 2026-08-15. The stack reached straight into the
+      e1000: `net.c` called `e1000_present()`, the lwIP glue was called
+      `netif_e1000.c`, and a second NIC driver would have meant editing the
+      protocol stack to add itself. A driver now publishes a
+      `struct netdev_ops` (include/netdev.h) and nothing above it learns its
+      name; lwIP gets one netif per bound device, `/proc/netif` lists them all,
+      and the e1000 drives up to four cards rather than refusing the second.
+      Verified with two NICs attached: `eth0` and `eth1`, each with its own MAC
+      and its own DHCP lease.
 - [ ] `accept()` does not report the peer's address, and there is no
       `getsockname`/`getpeername`. Nothing has needed them yet; a server that
       wants to log who connected will.
+- [ ] No routing table. With two interfaces up, the first is the default route
+      and the second is reachable only by an address on its own subnet. That is
+      a rule rather than an accident, but it is not routing.
 - [ ] Receive is still polled. The network thread looks at the NIC every timer
       tick when the link is idle, so an arriving frame waits up to 10 ms before
       anything sees it. Waking that thread from the e1000 interrupt is the real