feat(kernel): seL4-style IPC, notifications, status ABI

- badges + Mint, Call/Reply/ReplyRecv w/ gen-checked reply slot
- cap transfer (1/msg, copy, needs Delegate, rechecked at delivery)
- notifications: signal/wait/poll/bind, irq -> notification routing
- WaitAny/WaitForInterrupt removed; a0=status, ErrorCode
- libkos: single ecall primitive, compat wrappers + typed new api
- fix: trap return clobbered user t0 on every trap
- fix: wait queues FIFO, delegate keeps badge, fault cap checked
- docs/ipc.md spec, ipc tests, ipc fuzz, kani ntfn + waitqueue

crates/domain/src/irq/mod.rs

@@ -1,6 +1,8 @@
-use types::id::{IrqId, ThreadId};
-
-use crate::error::KernelError;
+use types::{
+    badge::Badge,
+    generation::Generation,
+    id::{IrqId, NotificationId},
+};
 
 #[cfg(test)]
 #[path = "tests.rs"]
@@ -8,47 +10,47 @@ mod tests;
 
 const MAX_IRQS: usize = 256;
 
+/// Where an interrupt is delivered: a signal on a notification, through a
+/// capability snapshot (generation and badge) taken when the route was set.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct IrqRoute {
+    pub notification: NotificationId,
+    pub generation: Generation,
+    pub badge: Badge,
+}
+
 pub struct IrqRoutingTable {
-    owners: [Option<ThreadId>; MAX_IRQS],
+    routes: [Option<IrqRoute>; MAX_IRQS],
 }
 
 impl IrqRoutingTable {
     pub fn new() -> Self {
         Self {
-            owners: [None; MAX_IRQS],
+            routes: [None; MAX_IRQS],
         }
     }
 
-    pub fn register(&mut self, irq: IrqId, thread: ThreadId) -> Result<(), KernelError> {
-        let slot = self
-            .owners
-            .get_mut(irq.raw() as usize)
-            .ok_or(KernelError::InvalidIrq(irq))?;
-        if slot.is_some() {
-            return Err(KernelError::IrqAlreadyOwned(irq));
+    /// Routes `irq`, replacing any previous route. Fails for lines beyond
+    /// the table.
+    pub fn set(&mut self, irq: IrqId, route: IrqRoute) -> bool {
+        match self.routes.get_mut(irq.raw() as usize) {
+            Some(slot) => {
+                *slot = Some(route);
+                true
+            }
+            None => false,
         }
-        *slot = Some(thread);
-        Ok(())
     }
 
-    pub fn unregister(&mut self, irq: IrqId) {
-        if let Some(slot) = self.owners.get_mut(irq.raw() as usize) {
+    pub fn clear(&mut self, irq: IrqId) {
+        if let Some(slot) = self.routes.get_mut(irq.raw() as usize) {
             *slot = None;
         }
     }
 
-    /// Drops every route to `thread`, e.g. when it dies.
-    pub fn unregister_thread(&mut self, thread: ThreadId) {
-        for slot in &mut self.owners {
-            if *slot == Some(thread) {
-                *slot = None;
-            }
-        }
-    }
-
-    /// The thread an interrupt is routed to; `None` for unknown lines.
-    pub fn owner(&self, irq: IrqId) -> Option<ThreadId> {
-        *self.owners.get(irq.raw() as usize)?
+    /// The route for `irq`; `None` for unknown or unrouted lines.
+    pub fn route(&self, irq: IrqId) -> Option<IrqRoute> {
+        *self.routes.get(irq.raw() as usize)?
     }
 }