reorg: relocate device/service clients (C3/C4)

- device.zig + device-manager.zig -> library/device/driver/driver.zig (module
  "driver"): the driver author's whole interface — device access (claim/mmioMap/
  irqBind/...) plus the device-manager hello() handshake, folded into one import.
- block.zig -> library/device/block/block.zig (a device type).
- display.zig/input.zig -> library/client/{display,input}/ (userspace-service
  clients — they talk to services, not the kernel).

build.zig module graph updated; the runtime shim now maps runtime.device and
runtime.device_manager onto "driver", so consumers stay untouched (migrated in C2).

zig build green; driver-restart, usb-storage, display-native, input pass.

library/device/block/block.zig

@@ -0,0 +1,79 @@
+//! Block-device client: the helper a filesystem uses to read and write a block
+//! device (a USB stick, via usb-storage) without hand-rolling the block-protocol
+//! IPC. Layered over `ipc` and the shared `block-protocol` wire format, like
+//! `runtime.usb` over the transfer protocol.
+//!
+//! Transfers name a caller-owned DMA buffer by physical address (from
+//! `runtime.dma.alloc`), so whole sectors move without crossing the IPC size
+//! limit — the same handoff usb-storage uses toward the controller.
+
+const std = @import("std");
+const ipc = @import("ipc");
+const time = @import("time");
+const block_protocol = @import("block-protocol");
+
+pub const Geometry = struct { block_size: u32, block_count: u64 };
+
+pub const Device = struct {
+    endpoint: ipc.Handle,
+
+    /// The device's block size and total block count.
+    pub fn geometry(self: Device) ?Geometry {
+        var request = block_protocol.Request{ .operation = @intFromEnum(block_protocol.Operation.geometry), .lba = 0, .count = 0, .physical = 0 };
+        var reply: [block_protocol.reply_size]u8 = undefined;
+        const n = ipc.call(self.endpoint, std.mem.asBytes(&request), &reply) catch return null;
+        if (n < block_protocol.reply_size) return null;
+        const result = std.mem.bytesToValue(block_protocol.Reply, reply[0..block_protocol.reply_size]);
+        if (result.status != 0) return null;
+        return .{ .block_size = result.block_size, .block_count = result.block_count };
+    }
+
+    /// Read `count` blocks starting at `lba` into the DMA buffer at `physical`.
+    pub fn read(self: Device, lba: u64, count: u32, physical: u64) bool {
+        return self.transfer(.read, lba, count, physical);
+    }
+
+    /// Write `count` blocks starting at `lba` from the DMA buffer at `physical`.
+    pub fn write(self: Device, lba: u64, count: u32, physical: u64) bool {
+        return self.transfer(.write, lba, count, physical);
+    }
+
+    /// Commit any device write cache to stable media (SCSI SYNCHRONIZE CACHE), so
+    /// prior writes survive a power-off. A filesystem calls this before the machine
+    /// goes down; no data transfer, so the buffer arguments are unused.
+    pub fn flush(self: Device) bool {
+        return self.transfer(.flush, 0, 0, 0);
+    }
+
+    fn transfer(self: Device, operation: block_protocol.Operation, lba: u64, count: u32, physical: u64) bool {
+        var request = block_protocol.Request{ .operation = @intFromEnum(operation), .lba = lba, .count = count, .physical = physical };
+        var reply: [block_protocol.reply_size]u8 = undefined;
+        const n = ipc.call(self.endpoint, std.mem.asBytes(&request), &reply) catch return false;
+        if (n < block_protocol.reply_size) return false;
+        return std.mem.bytesToValue(block_protocol.Reply, reply[0..block_protocol.reply_size]).status == 0;
+    }
+};
+
+/// One lookup attempt, no waiting — for a server that retries on its own
+/// timer (the fat service) instead of blocking its harness in here.
+pub fn tryOpen() ?Device {
+    if (ipc.lookup(.block)) |handle| return .{ .endpoint = handle };
+    return null;
+}
+
+/// Look up the block device, retrying generously while the USB storage chain
+/// (controller reset, enumeration, mass-storage bring-up) comes up.
+pub fn open() ?Device {
+    // Patient: the whole USB storage chain (firmware discovery, xHCI reset and
+    // enumeration, mass-storage bring-up) must complete first, which can take
+    // tens of seconds under emulation.
+    var attempts: usize = 0;
+    // 30 s covers the slowest observed healthy chain (a flaky QEMU enumeration
+    // completed at ~24 s); a machine whose stick genuinely failed setup should
+    // not sit a further minute pretending otherwise.
+    while (attempts < 600) : (attempts += 1) {
+        if (ipc.lookup(.block)) |handle| return .{ .endpoint = handle };
+        time.sleepMillis(50);
+    }
+    return null;
+}

library/device/driver/driver.zig

@@ -0,0 +1,173 @@
+//! library/device/driver — the driver author's interface: enumerate the kernel's device
+//! table, claim a device, map its MMIO, bind its interrupt (the claim is the capability the
+//! kernel checks before mapping registers or routing an IRQ), and say `hello` to the device
+//! manager at startup. The whole kernel + manager surface a driver needs, in one import.
+
+const std = @import("std");
+const abi = @import("abi");
+const device_abi = @import("device-abi");
+const sc = @import("system-call");
+const ipc = @import("ipc");
+const time = @import("time");
+const device_manager_protocol = @import("device-manager-protocol");
+
+pub const DeviceDescriptor = device_abi.DeviceDescriptor;
+pub const ResourceDescriptor = device_abi.ResourceDescriptor;
+pub const DeviceClass = device_abi.DeviceClass;
+pub const ResourceKind = device_abi.ResourceKind;
+
+inline fn failed(r: usize) bool {
+    return r > ~@as(usize, 0) - 4095;
+}
+
+/// Copy up to `buffer.len` device descriptors into `buffer`; returns the total count.
+pub fn enumerate(buffer: []DeviceDescriptor) usize {
+    return sc.systemCall2(.device_enumerate, @intFromPtr(buffer.ptr), buffer.len);
+}
+
+/// Take exclusive ownership of device `id`. Returns false if taken or invalid.
+pub fn claim(id: u64) bool {
+    return !failed(sc.systemCall1(.device_claim, id));
+}
+
+/// Map resource `resource_index` (which must be an MMIO window) of claimed device
+/// `device_id` into this address space; returns the register base virtual address.
+pub fn mmioMap(device_id: u64, resource_index: u64) ?usize {
+    const r = sc.systemCall2(.mmio_map, device_id, resource_index);
+    return if (failed(r)) null else r;
+}
+
+/// `DeviceDescriptor.parent` for a device with no parent.
+pub const no_parent = device_abi.no_parent;
+
+/// `DeviceDescriptor.pci_class` for a device that is not a PCI function. Set this on
+/// descriptors passed to `register` unless the child really is one.
+pub const no_pci_class = device_abi.no_pci_class;
+
+/// Publish `descriptor` as a child of `parent_id`, which this process must have claimed.
+/// Returns the new device id. The child is left unclaimed, so whichever driver owns
+/// that class of device can `claim` it — that is how a bus hands off a device.
+///
+/// Every resource in `descriptor` must be **contained** in a parent resource of the same
+/// kind: a sub-window of the parent's MMIO, or one of its IRQs. The kernel refuses
+/// anything else, because a device descriptor is a licence to map physical memory and
+/// a bus driver may only subdivide what it already owns. `descriptor.id` and `descriptor.parent`
+/// are ignored. A device with no resources at all is fine — a USB device is reached
+/// through its controller, not by MMIO.
+pub fn register(parent_id: u64, descriptor: *const DeviceDescriptor) ?u64 {
+    const r = sc.systemCall2(.device_register, parent_id, @intFromPtr(descriptor));
+    return if (failed(r)) null else r;
+}
+
+/// Bind resource `resource_index` (which must be an IRQ) of claimed device `device_id` to
+/// `endpoint`. From then on the interrupt arrives as an asynchronous notification:
+/// `ipc.replyWait` on that endpoint returns with the high bit set in `badge` and the
+/// low bits carrying the GSI. The kernel masks the line before waking you.
+pub fn irqBind(device_id: u64, resource_index: u64, endpoint: usize) bool {
+    return !failed(sc.systemCall3(.irq_bind, device_id, resource_index, endpoint));
+}
+
+/// Re-arm a bound IRQ. Call this **after** quieting the device (clearing whatever
+/// status register holds its line asserted) — the kernel left the line masked
+/// precisely because it could not do that for you. Skip it and the interrupt never
+/// fires again; call it before the device is quiet and a level-triggered line storms.
+pub fn irqAck(device_id: u64, resource_index: u64) bool {
+    return !failed(sc.systemCall2(.irq_ack, device_id, resource_index));
+}
+
+/// The Message-Signalled Interrupt address/data a driver programs into its device's
+/// MSI capability. The device raises the interrupt by writing `data` to `address`.
+pub const Msi = struct { address: u64, data: u32 };
+
+/// Set up MSI for a claimed device: the kernel allocates a per-device edge-triggered
+/// vector, binds it to `endpoint` (delivered like `irqBind`, but with no mask and no
+/// `irqAck` cycle), and returns the (address, data) to write into the device's MSI
+/// capability — found by mmio_mapping the device's ECAM config space (resource 0) and
+/// walking its capability list. Returns null on failure. Two return values (address in
+/// rax, data in rdx), so a hand-written stub.
+pub fn msiBind(device_id: u64, endpoint: usize) ?Msi {
+    var rax: usize = undefined;
+    var rdx: usize = undefined;
+    asm volatile ("syscall"
+        : [rax] "={rax}" (rax),
+          [rdx] "={rdx}" (rdx),
+        : [n] "{rax}" (@intFromEnum(abi.SystemCall.msi_bind)),
+          [a0] "{rdi}" (device_id),
+          [a1] "{rsi}" (endpoint),
+        : .{ .rcx = true, .r11 = true, .memory = true });
+    if (failed(rax)) return null;
+    return .{ .address = rax, .data = @intCast(rdx) };
+}
+
+/// Read `width` bytes (1, 2, or 4) from a port in a claimed device's `io_port`
+/// resource, at byte `offset` within it. Ring 3 has no direct `in`/`out`, so a legacy
+/// driver (PS/2, 16550 UART) reaches its ports through this claim-gated call — each
+/// access is a syscall, which is fine for the low-rate hardware that needs it. Returns
+/// null if the capability check fails (device not claimed, wrong resource, out of
+/// range). A device that decodes no data returns all-ones, which is a valid value, not
+/// a failure.
+pub fn ioRead(device_id: u64, resource_index: u64, offset: u64, width: u8) ?u32 {
+    const r = sc.systemCall4(.io_read, device_id, resource_index, offset, width);
+    return if (failed(r)) null else @intCast(r);
+}
+
+/// Write `value` (its low `width` bytes, 1/2/4) to a port in a claimed device's
+/// `io_port` resource, at byte `offset`. Same capability gate as `ioRead`.
+pub fn ioWrite(device_id: u64, resource_index: u64, offset: u64, width: u8, value: u32) bool {
+    return !failed(sc.systemCall5(.io_write, device_id, resource_index, offset, width, value));
+}
+
+/// Find DeviceDescription by hid
+///
+/// Utility function for driver development
+pub fn findDeviceDescriptorByHid(buffer: []DeviceDescriptor, hid_needle: []const u8) ?DeviceDescriptor {
+    const total = enumerate(buffer);
+    const n = @min(total, buffer.len);
+    for (@as([]DeviceDescriptor, buffer[0..n])) |d| {
+        const hid_haystack = d.hid[0..@intCast(d.hid_len)];
+        if (std.mem.eql(u8, hid_haystack, hid_needle)) {
+            return d;
+        }
+    }
+
+    return null;
+}
+
+// --- device-manager handshake (folded in from the former device-manager.zig) ---
+
+/// What kind of driver is announcing itself (a bus that reports children, or a leaf
+/// device). Re-exported so callers name it without importing the protocol.
+pub const Role = device_manager_protocol.Role;
+
+const lookup_attempts: u32 = 100;
+const lookup_pause_ms: u64 = 20;
+
+/// Say hello to the device manager and return its endpoint, or null if there is no manager
+/// (best-effort standalone bring-up) or it refused the handshake. Bus drivers keep the handle
+/// to report children through; a driver that runs fine unsupervised discards it with `_ =`,
+/// and one that requires supervision bails on null. Logs the outcome itself.
+pub fn hello(role: Role, device_id: u64) ?ipc.Handle {
+    var attempts: u32 = 0;
+    const manager = while (attempts < lookup_attempts) : (attempts += 1) {
+        if (ipc.lookup(.device_manager)) |handle| break handle;
+        time.sleepMillis(lookup_pause_ms);
+    } else {
+        std.log.info("no device manager to hello", .{});
+        return null;
+    };
+
+    const message = device_manager_protocol.Hello{ .role = @intFromEnum(role), .device_id = device_id };
+    var reply: [device_manager_protocol.reply_size]u8 = undefined;
+    const length = ipc.call(manager, std.mem.asBytes(&message), &reply) catch {
+        std.log.info("hello call failed", .{});
+        return null;
+    };
+    if (length < device_manager_protocol.reply_size or
+        std.mem.bytesToValue(device_manager_protocol.HelloReply, reply[0..device_manager_protocol.reply_size]).status != 0)
+    {
+        std.log.info("hello refused", .{});
+        return null;
+    }
+    std.log.info("hello acknowledged", .{});
+    return manager;
+}