M11–M12: IRQ-as-IPC and bus drivers; expand names tree-wide

Two driver-model milestones plus a tree-wide naming pass. Suite 35/35
(QEMU) + host tests green.

M11 — IRQ-as-IPC. A ring-3 driver now sleeps until its device interrupts
it. New src/kernel/irq.zig: per-GSI endpoint bindings, comptime per-vector
trampolines, dispatch = mask GSI -> LAPIC EOI -> notifyLocked, all under one
lock region. irq_bind/irq_ack syscalls, gated by the device claim like
mmio_map. interruptDispatch no longer EOIs — each handler owns its EOI,
because a level line must be masked before it is acknowledged (irq_ack is
the unmask). Bindings are keyed on the owning task and released on exit
(a shared endpoint's siblings survive). hpetd rewritten interrupt-driven.
Tests: hpet (rewritten, reads back the I/O APIC routing) and irqfree.

M12 — bus drivers. DeviceDesc gains a parent, making the device table a
tree. dev_register (device_register) lets a process publish children below
a device it claimed; the kernel enforces resource containment (a child's
resources must nest in its parent's), so a descriptor can't fabricate a
window over kernel RAM. Descriptor copied in via copyFromUser (physmap
walk — an unmapped user pointer fails the call instead of faulting the
kernel). Per-parent child cap bounds table exhaustion. sbin/busd.zig is a
worked bus driver. Test: bus.

Naming — per docs/coding-standards.md: non-acronym abbreviations spelled
out (message, descriptor, device_service, scheduler, runtime, physical,
interpreter, ...); acronyms kept (IPC, MMIO, DMA, HCD, ...); files are
kebab-case (ipc-synchronous.zig, device-service.zig, vfs-protocol.zig, ...).
Exceptions: POSIX/C ABI names and Zig idioms (init/len/ptr) kept. Module
collisions resolved by specific naming (config -> parameters, device.zig
alias -> device_model). AML op/Op disambiguated: op = opcode, Op =
operation; per-opcode parse handlers renamed opX -> parseX.

New driver docs: drivers.md, driver-model.md (bus/class/HCD shapes + the
proposed M13–M16 ABI), coding-standards.md.

lib/ipc.zig

@@ -4,7 +4,7 @@
 //! added with the first server binary.
 
 const danos = @import("danos");
-const sc = @import("syscall.zig");
+const sc = @import("system-call.zig");
 
 /// A small-int handle into the calling process's handle table.
 pub const Handle = usize;
@@ -18,61 +18,77 @@ pub const Message = extern struct {
     c: u64 = 0,
 };
 
-/// Whether a syscall return value is a wrapped -errno (lands in the top page).
+/// Whether a system_call return value is a wrapped -errno (lands in the top page).
 inline fn failed(r: usize) bool {
     return r > ~@as(usize, 0) - 4095;
 }
 
 /// Create a new endpoint owned by this process; returns its handle.
 pub fn createEndpoint() ?Handle {
-    const r = sc.syscall0(.create_endpoint);
+    const r = sc.systemCall0(.create_endpoint);
     return if (failed(r)) null else r;
 }
 
 /// Publish endpoint `h` under a well-known service id so other processes find it.
 pub fn register(id: danos.ServiceId, h: Handle) bool {
-    return !failed(sc.syscall2(.ipc_register, @intFromEnum(id), h));
+    return !failed(sc.systemCall2(.ipc_register, @intFromEnum(id), h));
 }
 
 /// Find the endpoint published under `id`, installing a handle to it in this
 /// process.
 pub fn lookup(id: danos.ServiceId) ?Handle {
-    const r = sc.syscall1(.ipc_lookup, @intFromEnum(id));
+    const r = sc.systemCall1(.ipc_lookup, @intFromEnum(id));
     return if (failed(r)) null else r;
 }
 
 pub const CallError = error{Failed};
 
-/// Send `msg` to endpoint `h` and block until the server replies into `reply`.
+/// Send `message` to endpoint `h` and block until the server replies into `reply`.
 /// Returns the reply length.
-pub fn call(h: Handle, msg: []const u8, reply: []u8) CallError!usize {
-    const r = sc.syscall5(.ipc_call, h, @intFromPtr(msg.ptr), msg.len, @intFromPtr(reply.ptr), reply.len);
+pub fn call(h: Handle, message: []const u8, reply: []u8) CallError!usize {
+    const r = sc.systemCall5(.ipc_call, h, @intFromPtr(message.ptr), message.len, @intFromPtr(reply.ptr), reply.len);
     return if (failed(r)) error.Failed else r;
 }
 
+/// Set in `Received.badge` when what arrived is an asynchronous notification — a
+/// bound device interrupt — rather than a client's message. The low bits carry the
+/// GSI. See `isNotification`.
+pub const notify_badge_bit: u64 = danos.notify_badge_bit;
+
 /// The result of a `replyWait`: the request length and the sender's badge (a
 /// task id, or an IRQ notification if the high bit is set).
 pub const Received = struct {
     len: usize,
     badge: u64,
+
+    /// True if this wake-up was a device interrupt, not a client request. A driver's
+    /// event loop branches on this; there is no reply owed on the notification path.
+    pub fn isNotification(self: Received) bool {
+        return self.badge & notify_badge_bit != 0;
+    }
+
+    /// The interrupt source (a GSI), meaningful only when `isNotification`.
+    pub fn source(self: Received) u64 {
+        return self.badge & ~notify_badge_bit;
+    }
 };
 
 /// Server side of IPC_ReplyWait: deliver `reply` to the client last received (if
-/// any), then block until the next request arrives in `recv`. Returns its length
-/// and the sender badge. This syscall returns two values — the length in rax and
+/// any), then block until the next request arrives in `receive`. Returns its length
+/// and the sender badge. This system_call returns two values — the length in rax and
 /// the badge in rdx — so it needs a hand-written stub: rdx is a read-write
 /// operand (input = reply length, arg #3; output = badge).
-pub fn replyWait(h: Handle, reply: []const u8, recv: []u8) Received {
+pub fn replyWait(h: Handle, reply: []const u8, receive: []u8) Received {
     var rax: usize = undefined;
     var rdx: usize = reply.len; // in: reply_len (arg #3 -> rdx); out: badge
     asm volatile ("syscall"
         : [rax] "={rax}" (rax),
           [rdx] "+{rdx}" (rdx),
-        : [n] "{rax}" (@intFromEnum(danos.Syscall.ipc_reply_wait)),
+        : [n] "{rax}" (@intFromEnum(danos.SystemCall.ipc_reply_wait)),
           [a0] "{rdi}" (h),
           [a1] "{rsi}" (@intFromPtr(reply.ptr)),
-          [a3] "{r10}" (@intFromPtr(recv.ptr)),
-          [a4] "{r8}" (recv.len),
+          [a3] "{r10}" (@intFromPtr(receive.ptr)),
+          [a4] "{r8}" (receive.len),
         : .{ .rcx = true, .r11 = true, .memory = true });
     return .{ .len = rax, .badge = rdx };
 }