feat(kernel): seL4-style IPC, notifications, status ABI

- badges + Mint, Call/Reply/ReplyRecv w/ gen-checked reply slot
- cap transfer (1/msg, copy, needs Delegate, rechecked at delivery)
- notifications: signal/wait/poll/bind, irq -> notification routing
- WaitAny/WaitForInterrupt removed; a0=status, ErrorCode
- libkos: single ecall primitive, compat wrappers + typed new api
- fix: trap return clobbered user t0 on every trap
- fix: wait queues FIFO, delegate keeps badge, fault cap checked
- docs/ipc.md spec, ipc tests, ipc fuzz, kani ntfn + waitqueue

crates/domain/src/irq/mod.rs

@@ -1,6 +1,8 @@
-use types::id::{IrqId, ThreadId};
-
-use crate::error::KernelError;
+use types::{
+    badge::Badge,
+    generation::Generation,
+    id::{IrqId, NotificationId},
+};
 
 #[cfg(test)]
 #[path = "tests.rs"]
@@ -8,47 +10,47 @@ mod tests;
 
 const MAX_IRQS: usize = 256;
 
+/// Where an interrupt is delivered: a signal on a notification, through a
+/// capability snapshot (generation and badge) taken when the route was set.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct IrqRoute {
+    pub notification: NotificationId,
+    pub generation: Generation,
+    pub badge: Badge,
+}
+
 pub struct IrqRoutingTable {
-    owners: [Option<ThreadId>; MAX_IRQS],
+    routes: [Option<IrqRoute>; MAX_IRQS],
 }
 
 impl IrqRoutingTable {
     pub fn new() -> Self {
         Self {
-            owners: [None; MAX_IRQS],
+            routes: [None; MAX_IRQS],
         }
     }
 
-    pub fn register(&mut self, irq: IrqId, thread: ThreadId) -> Result<(), KernelError> {
-        let slot = self
-            .owners
-            .get_mut(irq.raw() as usize)
-            .ok_or(KernelError::InvalidIrq(irq))?;
-        if slot.is_some() {
-            return Err(KernelError::IrqAlreadyOwned(irq));
+    /// Routes `irq`, replacing any previous route. Fails for lines beyond
+    /// the table.
+    pub fn set(&mut self, irq: IrqId, route: IrqRoute) -> bool {
+        match self.routes.get_mut(irq.raw() as usize) {
+            Some(slot) => {
+                *slot = Some(route);
+                true
+            }
+            None => false,
         }
-        *slot = Some(thread);
-        Ok(())
     }
 
-    pub fn unregister(&mut self, irq: IrqId) {
-        if let Some(slot) = self.owners.get_mut(irq.raw() as usize) {
+    pub fn clear(&mut self, irq: IrqId) {
+        if let Some(slot) = self.routes.get_mut(irq.raw() as usize) {
             *slot = None;
         }
     }
 
-    /// Drops every route to `thread`, e.g. when it dies.
-    pub fn unregister_thread(&mut self, thread: ThreadId) {
-        for slot in &mut self.owners {
-            if *slot == Some(thread) {
-                *slot = None;
-            }
-        }
-    }
-
-    /// The thread an interrupt is routed to; `None` for unknown lines.
-    pub fn owner(&self, irq: IrqId) -> Option<ThreadId> {
-        *self.owners.get(irq.raw() as usize)?
+    /// The route for `irq`; `None` for unknown or unrouted lines.
+    pub fn route(&self, irq: IrqId) -> Option<IrqRoute> {
+        *self.routes.get(irq.raw() as usize)?
     }
 }
 

crates/domain/src/irq/tests.rs

@@ -1,50 +1,43 @@
 use super::*;
-use types::id::{IrqId, ThreadId};
+use types::badge::Badge;
+use types::generation::Generation;
+use types::id::{IrqId, NotificationId};
 
-fn irq(id: u16) -> IrqId {
-    IrqId::from_raw(id)
-}
-
-fn thread(id: u16) -> ThreadId {
-    ThreadId::from_raw(id)
+fn route(n: u16) -> IrqRoute {
+    IrqRoute {
+        notification: NotificationId::from_raw(n),
+        generation: Generation::initial(),
+        badge: Badge::new(1 << n),
+    }
 }
 
 #[test]
-fn new_table_has_no_owners() {
-    let table = IrqRoutingTable::new();
-    assert!(table.owner(irq(0)).is_none());
-    assert!(table.owner(irq(10)).is_none());
+fn new_table_routes_nothing() {
+    let t = IrqRoutingTable::new();
+    assert_eq!(t.route(IrqId::from_raw(10)), None);
 }
 
 #[test]
-fn register_and_lookup() {
-    let mut table = IrqRoutingTable::new();
-    table.register(irq(5), thread(1)).unwrap();
-    assert_eq!(table.owner(irq(5)), Some(thread(1)));
+fn set_then_route() {
+    let mut t = IrqRoutingTable::new();
+    assert!(t.set(IrqId::from_raw(10), route(3)));
+    assert_eq!(t.route(IrqId::from_raw(10)), Some(route(3)));
 }
 
 #[test]
-fn register_already_owned_fails() {
-    let mut table = IrqRoutingTable::new();
-    table.register(irq(5), thread(1)).unwrap();
-    assert!(table.register(irq(5), thread(2)).is_err());
+fn set_replaces_and_clear_removes() {
+    let mut t = IrqRoutingTable::new();
+    t.set(IrqId::from_raw(10), route(3));
+    t.set(IrqId::from_raw(10), route(4));
+    assert_eq!(t.route(IrqId::from_raw(10)), Some(route(4)));
+    t.clear(IrqId::from_raw(10));
+    assert_eq!(t.route(IrqId::from_raw(10)), None);
 }
 
 #[test]
-fn unregister_then_reregister() {
-    let mut table = IrqRoutingTable::new();
-    table.register(irq(5), thread(1)).unwrap();
-    table.unregister(irq(5));
-    assert!(table.owner(irq(5)).is_none());
-    table.register(irq(5), thread(2)).unwrap();
-    assert_eq!(table.owner(irq(5)), Some(thread(2)));
-}
-
-#[test]
-fn different_irqs_independent() {
-    let mut table = IrqRoutingTable::new();
-    table.register(irq(0), thread(10)).unwrap();
-    table.register(irq(1), thread(20)).unwrap();
-    assert_eq!(table.owner(irq(0)), Some(thread(10)));
-    assert_eq!(table.owner(irq(1)), Some(thread(20)));
+fn lines_beyond_the_table_are_rejected_without_panicking() {
+    let mut t = IrqRoutingTable::new();
+    assert!(!t.set(IrqId::from_raw(1000), route(1)));
+    assert_eq!(t.route(IrqId::from_raw(1000)), None);
+    t.clear(IrqId::from_raw(1000));
 }