hybrid: the driver is killed, and the driver comes back

H2 of docs/plan/hybrid.md -- the milestone the plan itself calls the one
that proves the whole idea, and the one that cannot be skipped.

    # cat /proc/schinit
    1 4 11 os.schos.vgpud
    # kill 4
    schinitd: restarting os.schos.vgpud
    vgpud: claimed
    vgpud: pid 8 drew a test pattern from userspace

The test pattern ends in a twelve-block tally of the drawing process's
pid, because a second run that redraws an identical picture is
indistinguishable from a first run that never stopped. Read off the
virtio-gpu scanout across four generations it says 4, 8, 10, 12, and the
DMA arena hands back the same physical address every time.

What it took:

* A halt the kernel can apply to a device it does not understand.
  Clearing PCI_CMD_BUS_MASTER is the only one there is, and it has to
  happen before the DMA goes back to the arena -- a dead driver's device
  keeps reading a framebuffer the kernel is about to give to somebody
  else. Claim sets the bit, release clears it; pcitest shows it in a bm
  column, with a third state so a failed read is never printed as off.

* A refusal. vgpu_release() asks vga_fb_restore() whether there is a
  framebuffer to put the console back on, and declines to hand over the
  device if there is not. The rule that the kernel keeps a minimal
  driver for everything on the path to a shell is worth writing down
  only if something enforces it.

* The DMA arena not being owned by two allocators at once. This is the
  bug that stopped H2: freevm() frees every mapped page below PHYSTOP
  and the arena is the top 16 MB of exactly that range, so a DMA block
  mapped into a driver went onto the page allocator's free list when the
  driver died, while pciuser_release_all() handed the same pages back to
  the arena. The restarted vgpud asked for its framebuffer, got pages
  kalloc() had already given out -- including its own page tables -- and
  dma_alloc()'s zeroing wiped them, so it died inside the ioctl on the
  return from a syscall whose stack had stopped existing. do_dma() now
  records a VMA with no_free set, the way shared memory does.

* One exit status. KeepAlive must restart a driver that crashed and must
  not restart one that has looked at the machine and found its device
  absent: on hardware with no virtio-gpu that was fifteen spawns in
  forty-five seconds, each printing a line to the console, for ever.
  SCHINIT_EXIT_NORESTART is 78, sysexits.h's EX_CONFIG. It is not a new
  manifest key -- the wait status has always travelled from PID 1 to the
  supervisor, and note_exit() simply stopped discarding it.

The milestone's third clause, "the compositor reattaches", is not done
and is not claimed: there is no compositor running. That is recorded in
the plan as a Schcom milestone rather than counted here.

Closes the register row "A released PCI device" in docs/plan/1.0.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

cmd/pcitest/main.c

@@ -93,12 +93,31 @@ main(int argc, char *argv[])
     }
 
     if (argc == 1) {
-        puts("  #  bdf       vendor:device  irq  class        driver\n");
+        puts("  #  bdf       vendor:device  irq  class        bm  driver\n");
         for (int i = 0; i < count; i++) {
             struct pciuser_info in;
             in.index = (unsigned int)i;
             if (ioctl(fd, PCIIOC_INFO, &in) < 0)
                 continue;
+
+            // Bus mastering, straight out of the command register.
+            //
+            // Worth a column of its own because it is the one bit that says
+            // whether a device can still touch memory, and the whole lifecycle
+            // turns on it: claiming a device sets it, releasing one clears it,
+            // and a driver that died leaves a device that must not be left
+            // reading buffers the kernel is about to hand to somebody else.
+            struct pciuser_cfg cfg;
+            cfg.index  = (unsigned int)i;
+            cfg.offset = 0x04;              // PCI_COMMAND
+            cfg.value  = 0;
+            // Three states, not two. A read that failed is not the same as a
+            // bit that is clear, and printing them the same way is how a
+            // column stops being evidence -- which is exactly what happened
+            // the first time this was run.
+            const char *bm = "?   ";
+            if (ioctl(fd, PCIIOC_CFG, &cfg) == 0)
+                bm = (cfg.value & 0x0004) ? "on  " : "--  ";
             puts("  "); putn(i); puts("  ");
             puthex(in.bus, 2); puts(":"); puthex(in.slot, 2);
             puts("."); puthex(in.func, 1); puts("   ");
@@ -106,6 +125,7 @@ main(int argc, char *argv[])
             if (in.irq == 0xFF) puts(" -  "); else { putn(in.irq); puts("   "); }
             puts(class_name(in.class));
             puts("      ");
+            puts(bm);
             puts(in.driver[0] ? in.driver : "-");
             puts("\n");
         }