feat: proper IPC-based boot — init loads servers from storage via IPC, VirtIO GPU driver

Complete microkernel boot pipeline: adapter loads only init + storage + display
from disk. Init bootstraps all other servers by reading binaries from the
storage server via IPC, parsing ELF, creating processes, mapping pages, and
spawning threads.

New syscalls:
- CreateEndpoint: userspace endpoint creation with full capability grant
- DebugPutchar: debug output to UART from userspace
- MapPage: cross-process page mapping (init loads binaries into children)
- SpawnThreadIn: spawn thread in another process via capability

Key fixes:
- Per-process L1 page tables for VPN[2]=0 (prevents cross-process corruption)
- Separate kernel_pt from page_tables[0] (init pid=0 overwrote kernel PT ref)
- Thread Running state set in switch_to_next (syscalls rejected without it)
- Pending IPC results applied during context switch
- SIE disabled during boot (timer can't preempt into unready processes)
- User heap VA starts at 0x40000 (avoids shared buffer at 0x30000)
- RequestPages maps at user VAs via per-process heap allocator

VirtIO GPU:
- Adapter probes for GPU device, initializes resource/scanout/backing
- Display server writes to mapped framebuffer, flushes via GPU virtqueue
- 640x480 BGRA framebuffer with transfer-to-host and resource-flush

Storage server:
- Userspace VirtIO block driver using pre-mapped MMIO and DMA pages
- FAT16 filesystem reader serving file-read requests via IPC
- Shared buffer protocol: init writes filename, storage writes file data

Echo app for IPC testing (adapter-loaded echo proved the pipeline end-to-end).

crates/adapter-riscv/src/board.rs

@@ -6,5 +6,5 @@ pub const VIRTIO_SIZE: usize = 0x8000;
 pub const PLIC_BASE: usize = 0x0C000000;
 pub const CLINT_BASE: usize = 0x02000000;
 pub const USER_POOL_BASE: usize = 0x84000000;
-pub const USER_POOL_PAGES: usize = 256;
+pub const USER_POOL_PAGES: usize = 4096;
 pub const TICK_INTERVAL: u64 = 10_000_000;

crates/adapter-riscv/src/hw/mod.rs

@@ -2,3 +2,4 @@ pub mod plic;
 pub mod timer;
 pub mod uart;
 pub mod virtio_blk;
+pub mod virtio_gpu;

crates/adapter-riscv/src/hw/virtio_blk.rs

@@ -77,11 +77,11 @@ static mut REQ_HEADER: VirtioBlkReqHeader = VirtioBlkReqHeader {
 
 static mut REQ_STATUS: u8 = 0xFF;
 
-fn mmio_read(base: usize, offset: usize) -> u32 {
+pub fn mmio_read(base: usize, offset: usize) -> u32 {
     unsafe { core::ptr::read_volatile((base + offset) as *const u32) }
 }
 
-fn mmio_write(base: usize, offset: usize, val: u32) {
+pub fn mmio_write(base: usize, offset: usize, val: u32) {
     unsafe { core::ptr::write_volatile((base + offset) as *mut u32, val) }
 }
 
@@ -91,6 +91,10 @@ pub struct VirtioBlk {
 }
 
 impl VirtioBlk {
+    pub fn base(&self) -> usize {
+        self.base
+    }
+
     pub fn probe() -> Option<Self> {
         for slot in 0..VIRTIO_MMIO_SLOTS {
             let base = VIRTIO_MMIO_FIRST + slot * VIRTIO_MMIO_STRIDE;

crates/adapter-riscv/src/hw/virtio_gpu.rs

@@ -0,0 +1,165 @@
+const VIRTIO_MAGIC: u32 = 0x74726976;
+const VIRTIO_GPU_DEVICE_ID: u32 = 16;
+const VIRTIO_MMIO_FIRST: usize = 0x10001000;
+const VIRTIO_MMIO_STRIDE: usize = 0x1000;
+const VIRTIO_MMIO_SLOTS: usize = 8;
+const QUEUE_SIZE: usize = 8;
+
+use super::virtio_blk::{mmio_read, mmio_write};
+
+pub struct VirtioGpu {
+    base: usize,
+}
+
+#[repr(C)]
+struct GpuCtrlHdr {
+    hdr_type: u32,
+    flags: u32,
+    fence_id: u64,
+    ctx_id: u32,
+    ring_idx: u8,
+    _pad: [u8; 3],
+}
+
+impl VirtioGpu {
+    pub fn probe() -> Option<Self> {
+        for slot in 0..VIRTIO_MMIO_SLOTS {
+            let base = VIRTIO_MMIO_FIRST + slot * VIRTIO_MMIO_STRIDE;
+            let magic = mmio_read(base, 0x000);
+            let device_id = mmio_read(base, 0x008);
+            if magic == VIRTIO_MAGIC && device_id == VIRTIO_GPU_DEVICE_ID {
+                return Some(Self { base });
+            }
+        }
+        None
+    }
+
+    pub fn base(&self) -> usize {
+        self.base
+    }
+
+    pub fn init_device(&self, vqueue_phys: usize) {
+        let base = self.base;
+
+        mmio_write(base, 0x070, 0);
+        while mmio_read(base, 0x070) != 0 {}
+
+        mmio_write(base, 0x070, 1); // ACK
+        mmio_write(base, 0x070, mmio_read(base, 0x070) | 2); // DRIVER
+        mmio_write(base, 0x028, 4096); // legacy guest page size
+        mmio_write(base, 0x014, 0); // features sel
+        mmio_write(base, 0x024, 0); // driver features sel
+        mmio_write(base, 0x020, 0); // driver features
+
+        // controlq (index 0)
+        mmio_write(base, 0x030, 0);
+        let qmax = mmio_read(base, 0x034);
+        let qnum = (QUEUE_SIZE as u32).min(qmax);
+        mmio_write(base, 0x038, qnum);
+        mmio_write(base, 0x040, (vqueue_phys / 4096) as u32);
+
+        mmio_write(base, 0x070, mmio_read(base, 0x070) | 4); // DRIVER_OK
+    }
+
+    pub fn setup_framebuffer(
+        &self,
+        cmd_buf_phys: usize,
+        vqueue_phys: usize,
+        fb_phys: usize,
+        width: u32,
+        height: u32,
+    ) {
+        self.send_create_2d(cmd_buf_phys, vqueue_phys, 1, width, height);
+        self.send_attach_backing(cmd_buf_phys, vqueue_phys, 1, fb_phys, width * height * 4);
+        self.send_set_scanout(cmd_buf_phys, vqueue_phys, 0, 1, width, height);
+    }
+
+    fn send_cmd(&self, cmd_phys: usize, cmd_len: u32, resp_phys: usize, resp_len: u32, vqueue_phys: usize) {
+        unsafe {
+            let descs = vqueue_phys as *mut [u64; 2]; // each desc = addr(u64) + len(u32) + flags(u16) + next(u16)
+            let desc0 = vqueue_phys as *mut u8;
+            // desc 0: request (readable)
+            core::ptr::write_volatile(desc0 as *mut u64, cmd_phys as u64);
+            core::ptr::write_volatile(desc0.add(8) as *mut u32, cmd_len);
+            core::ptr::write_volatile(desc0.add(12) as *mut u16, 1); // NEXT
+            core::ptr::write_volatile(desc0.add(14) as *mut u16, 1); // next=1
+
+            // desc 1: response (writable)
+            let desc1 = desc0.add(16);
+            core::ptr::write_volatile(desc1 as *mut u64, resp_phys as u64);
+            core::ptr::write_volatile(desc1.add(8) as *mut u32, resp_len);
+            core::ptr::write_volatile(desc1.add(12) as *mut u16, 2); // WRITE
+            core::ptr::write_volatile(desc1.add(14) as *mut u16, 0);
+
+            // avail ring: after descs (8 descs * 16 bytes = 128 bytes)
+            let avail = vqueue_phys + QUEUE_SIZE * 16;
+            let avail_idx = core::ptr::read_volatile((avail + 2) as *const u16);
+            core::ptr::write_volatile(
+                (avail + 4 + (avail_idx as usize % QUEUE_SIZE) * 2) as *mut u16,
+                0,
+            );
+            core::sync::atomic::fence(core::sync::atomic::Ordering::SeqCst);
+            core::ptr::write_volatile((avail + 2) as *mut u16, avail_idx.wrapping_add(1));
+            core::sync::atomic::fence(core::sync::atomic::Ordering::SeqCst);
+
+            mmio_write(self.base, 0x050, 0); // notify queue 0
+
+            // poll used ring (at page boundary = vqueue_phys + 4096)
+            let used = vqueue_phys + 4096;
+            let expected = avail_idx.wrapping_add(1);
+            let mut timeout = 10_000_000u32;
+            while core::ptr::read_volatile((used + 2) as *const u16) != expected {
+                core::hint::spin_loop();
+                timeout -= 1;
+                if timeout == 0 { return; }
+            }
+        }
+    }
+
+    fn send_create_2d(&self, cmd_phys: usize, vq_phys: usize, resource_id: u32, width: u32, height: u32) {
+        // cmd header (24 bytes) + create_2d fields (16 bytes) = 40 bytes
+        unsafe {
+            let p = cmd_phys as *mut u8;
+            core::ptr::write_bytes(p, 0, 4096);
+            core::ptr::write_volatile(p as *mut u32, 0x0101); // RESOURCE_CREATE_2D
+            core::ptr::write_volatile(p.add(24) as *mut u32, resource_id);
+            core::ptr::write_volatile(p.add(28) as *mut u32, 1); // B8G8R8A8_UNORM
+            core::ptr::write_volatile(p.add(32) as *mut u32, width);
+            core::ptr::write_volatile(p.add(36) as *mut u32, height);
+        }
+        let resp_phys = cmd_phys + 512;
+        self.send_cmd(cmd_phys, 40, resp_phys, 24, vq_phys);
+    }
+
+    fn send_attach_backing(&self, cmd_phys: usize, vq_phys: usize, resource_id: u32, fb_phys: usize, fb_size: u32) {
+        // header (24) + attach_backing (8) + mem_entry (16) = 48 bytes
+        unsafe {
+            let p = cmd_phys as *mut u8;
+            core::ptr::write_bytes(p, 0, 512);
+            core::ptr::write_volatile(p as *mut u32, 0x0104); // RESOURCE_ATTACH_BACKING
+            core::ptr::write_volatile(p.add(24) as *mut u32, resource_id);
+            core::ptr::write_volatile(p.add(28) as *mut u32, 1); // nr_entries
+            // mem_entry
+            core::ptr::write_volatile(p.add(32) as *mut u64, fb_phys as u64);
+            core::ptr::write_volatile(p.add(40) as *mut u32, fb_size);
+        }
+        let resp_phys = cmd_phys + 512;
+        self.send_cmd(cmd_phys, 48, resp_phys, 24, vq_phys);
+    }
+
+    fn send_set_scanout(&self, cmd_phys: usize, vq_phys: usize, scanout_id: u32, resource_id: u32, width: u32, height: u32) {
+        // header (24) + rect (16) + scanout_id (4) + resource_id (4) = 48 bytes
+        unsafe {
+            let p = cmd_phys as *mut u8;
+            core::ptr::write_bytes(p, 0, 512);
+            core::ptr::write_volatile(p as *mut u32, 0x0103); // SET_SCANOUT
+            // rect: x=0, y=0, width, height at offset 24
+            core::ptr::write_volatile(p.add(32) as *mut u32, width);
+            core::ptr::write_volatile(p.add(36) as *mut u32, height);
+            core::ptr::write_volatile(p.add(40) as *mut u32, scanout_id);
+            core::ptr::write_volatile(p.add(44) as *mut u32, resource_id);
+        }
+        let resp_phys = cmd_phys + 512;
+        self.send_cmd(cmd_phys, 48, resp_phys, 24, vq_phys);
+    }
+}

crates/adapter-riscv/src/main.rs

@@ -12,6 +12,7 @@ mod trap;
 use core::arch::global_asm;
 use hw::uart::Uart;
 use kernel_cell::KernelCell;
+use types::id::{ProcessId, ThreadId};
 
 static KERNEL: KernelCell<kernel::Kernel<platform::RiscVPlatform>> = KernelCell::uninit();
 
@@ -47,8 +48,24 @@ fn zero_bss() {
     }
 }
 
-const INIT_LOAD_VA: usize = 0x10000;
-const INIT_MAX_SIZE: usize = 64 * 1024;
+const USER_VA_BASE: usize = 0x10000;
+const MAX_FILE_SIZE: usize = 64 * 1024;
+const SHARED_BUF_VA: usize = 0x30000;
+const SHARED_BUF_PAGES: usize = 16;
+const STORAGE_VIRTIO_VA: usize = 0x20000;
+const STORAGE_VQUEUE_VA: usize = 0x21000;
+const STORAGE_REQHDR_VA: usize = 0x23000;
+const STORAGE_PHYSINFO_VA: usize = 0x24000;
+
+const DISPLAY_GPU_VA: usize = 0x20000;
+const DISPLAY_VQUEUE_VA: usize = 0x21000;
+const DISPLAY_CMDBUF_VA: usize = 0x23000;
+const DISPLAY_PHYSINFO_VA: usize = 0x24000;
+const DISPLAY_FB_VA: usize = 0x100000;
+const DISPLAY_FB_WIDTH: u32 = 640;
+const DISPLAY_FB_HEIGHT: u32 = 480;
+const DISPLAY_FB_BPP: usize = 4;
+const DISPLAY_FB_PAGES: usize = (DISPLAY_FB_WIDTH as usize * DISPLAY_FB_HEIGHT as usize * DISPLAY_FB_BPP + 4095) / 4096;
 
 #[unsafe(no_mangle)]
 extern "C" fn kmain() -> ! {
@@ -75,231 +92,427 @@ extern "C" fn kmain() -> ! {
     );
     KERNEL.init(kernel::Kernel::new(riscv_platform, pool));
 
-    let entry_va = load_init_from_disk(&uart, kernel_pt);
-
-    launch_init(&uart, entry_va);
-}
-
-fn load_init_from_disk(uart: &Uart, kernel_pt: &mmu::PageTable) -> usize {
-    // Probe VirtIO block device
-    let mut blk = match hw::virtio_blk::VirtioBlk::probe() {
-        Some(b) => {
-            uart.write_str("k-os: VirtIO block device found\n");
-            b
-        }
-        None => {
-            uart.write_str("k-os: no block device — using fallback init\n");
-            return load_fallback_init(kernel_pt);
-        }
-    };
-
-    // Read init.elf from FAT16 filesystem on disk
-    let init_page_count = (INIT_MAX_SIZE + 4095) / 4096;
-    let init_base = alloc_contiguous_pages(init_page_count);
-    let init_buf = unsafe {
-        core::slice::from_raw_parts_mut(init_base as *mut u8, INIT_MAX_SIZE)
-    };
-
-    let file_size = match boot_fs::read_file_from_disk(&mut blk, b"init.elf", init_buf) {
-        Some(size) => {
-            uart.write_str("k-os: loaded init.elf (");
-            uart.write_dec(size);
-            uart.write_str(" bytes)\n");
-            size
-        }
-        None => {
-            uart.write_str("k-os: init.elf not found on disk — using fallback\n");
-            return load_fallback_init(kernel_pt);
-        }
-    };
-
-    // Parse ELF and map segments
-    let entry_va = match elf::parse(&init_buf[..file_size]) {
-        Ok(elf_info) => {
-            uart.write_str("k-os: ELF entry point = ");
-            uart.write_hex(elf_info.entry_point);
-            uart.put_char(b'\n');
-
-            // Create a user page table with kernel mappings
-            let user_pt = mmu::create_user_page_table(
-                kernel_pt,
-                types::address::PhysicalAddress::from_raw(0),
-                0,
-                types::address::VirtualAddress::from_raw(0x10000),
-            );
-
-            // Map each PT_LOAD segment at its virtual address
-            for segment in elf_info.segments() {
-                let page_start = segment.vaddr & !0xFFF;
-                let offset_in_page = segment.vaddr & 0xFFF;
-                let total_size = offset_in_page + segment.mem_size;
-                let seg_pages = (total_size + 4095) / 4096;
-
-                for p in 0..seg_pages {
-                    let page = mmu::allocator::alloc_zeroed_page();
-
-                    let page_va_start = page_start + p * 4096;
-                    let seg_start_in_file = if p == 0 { 0 } else { p * 4096 - offset_in_page };
-                    let dest_offset = if p == 0 { offset_in_page } else { 0 };
-                    let copy_len = if seg_start_in_file < segment.file_size {
-                        (segment.file_size - seg_start_in_file).min(4096 - dest_offset)
-                    } else {
-                        0
-                    };
-
-                    if copy_len > 0 {
-                        let src = segment.file_offset + seg_start_in_file;
-                        if src + copy_len <= file_size {
-                            unsafe {
-                                core::ptr::copy_nonoverlapping(
-                                    init_buf.as_ptr().add(src),
-                                    (page as *mut u8).add(dest_offset),
-                                    copy_len,
-                                );
-                            }
-                        }
-                    }
-
-                    let flags = if segment.flags.execute {
-                        mmu::Sv39Flags::user_rx()
-                    } else if segment.flags.write {
-                        mmu::Sv39Flags::user_rw()
-                    } else {
-                        mmu::Sv39Flags::user_rx()
-                    };
-                    mmu::map(user_pt, mmu::Mapping {
-                        va: types::address::VirtualAddress::from_raw(page_va_start),
-                        pa: types::address::PhysicalAddress::from_raw(page),
-                        pages: 1,
-                        flags,
-                    });
-                }
-                uart.write_str("k-os: mapped segment at ");
-                uart.write_hex(segment.vaddr);
-                uart.write_str(" (");
-                uart.write_dec(seg_pages);
-                uart.write_str(" pages)\n");
-            }
-
-            // Map stack pages below the lowest segment (4 pages = 16K)
-            let stack_pages = 4;
-            for i in 0..stack_pages {
-                let stack_page = mmu::allocator::alloc_zeroed_page();
-                let stack_va = 0x10000 - (stack_pages - i) * 4096;
-                mmu::map(user_pt, mmu::Mapping {
-                    va: types::address::VirtualAddress::from_raw(stack_va),
-                    pa: types::address::PhysicalAddress::from_raw(stack_page),
-                    pages: 1,
-                    flags: mmu::Sv39Flags::user_rw(),
-                });
-            }
-
-            // Store page table for init process
-            let kern = kernel_ref();
-            let pt_addr = user_pt as *const mmu::PageTable as usize;
-            kern.platform_mut().set_page_table(
-                types::id::ProcessId::from_raw(0),
-                pt_addr,
-            );
-
-            elf_info.entry_point
-        }
-        Err(_) => {
-            uart.write_str("k-os: not valid ELF — loading as raw binary\n");
-            load_fallback_init(kernel_pt)
-        }
-    };
-
-    entry_va
-}
-
-// Fallback: minimal init that just calls SYS_EXIT (no disk needed)
-static FALLBACK_INIT: [u8; 12] = [
-    0x93, 0x08, 0x00, 0x01, // addi a7, zero, 16 (SYS_EXIT)
-    0x73, 0x00, 0x00, 0x00, // ecall
-    0x6f, 0xf0, 0xdf, 0xff, // j -4
-];
-
-fn load_fallback_init(kernel_pt: &mmu::PageTable) -> usize {
-    let page = mmu::allocator::alloc_zeroed_page();
-    unsafe {
-        core::ptr::copy_nonoverlapping(
-            FALLBACK_INIT.as_ptr(),
-            page as *mut u8,
-            FALLBACK_INIT.len(),
-        );
+    // --- Read init + storage from disk ---
+    let mut blk = hw::virtio_blk::VirtioBlk::probe();
+    if blk.is_none() {
+        halt(&uart, "no block device");
     }
-    let _user_pt = mmu::create_user_page_table(
-        kernel_pt,
-        types::address::PhysicalAddress::from_raw(page),
-        1,
-        types::address::VirtualAddress::from_raw(INIT_LOAD_VA),
-    );
-    use ::platform::Platform;
-    kernel_ref().platform_mut().configure_protection(
-        types::id::ProcessId::from_raw(0),
-        &[],
-    );
-    INIT_LOAD_VA
-}
+    uart.write_str("k-os: VirtIO block device found\n");
 
-fn alloc_contiguous_pages(count: usize) -> usize {
-    let first = mmu::allocator::alloc_zeroed_page();
-    for _ in 1..count {
-        mmu::allocator::alloc_zeroed_page();
-    }
-    first
-}
-
-fn launch_init(uart: &Uart, entry_va: usize) -> ! {
-    let kern = kernel_ref();
-
-    let (pid, tid) = kern
+    // Boot init (pid 0) — kern.boot() grants ProcessCreate cap at slot 0
+    let (init_pid, init_tid) = kernel_ref()
         .boot(types::bounded::Priority::DEFAULT, types::time::TimeSlice::DEFAULT)
-        .unwrap_or_else(|_| {
-            uart.write_str("k-os: FATAL — boot failed\n");
-            loop { unsafe { core::arch::asm!("wfi") }; }
+        .unwrap_or_else(|_| halt(&uart, "boot failed"));
+
+    let init_entry = load_elf_into_process(&uart, blk.as_mut(), kernel_pt, init_pid, b"init.elf");
+    if init_entry == 0 { halt(&uart, "init.elf not found"); }
+    setup_thread(init_tid, init_entry);
+    uart.write_str("k-os: init loaded\n");
+
+    // Load storage server
+    let storage_pid = kernel_ref().create_process_internal()
+        .unwrap_or_else(|| halt(&uart, "storage process failed"));
+    let storage_entry = load_elf_into_process(&uart, blk.as_mut(), kernel_pt, storage_pid, b"storage.elf");
+    if storage_entry == 0 { halt(&uart, "storage.elf not found"); }
+    let storage_tid = kernel_ref().spawn_thread_internal(storage_pid)
+        .unwrap_or_else(|| halt(&uart, "storage thread failed"));
+    setup_thread(storage_tid, storage_entry);
+    uart.write_str("k-os: storage loaded\n");
+
+    // Load display server
+    let display_pid = kernel_ref().create_process_internal()
+        .unwrap_or_else(|| halt(&uart, "display process failed"));
+    let display_entry = load_elf_into_process(&uart, blk.as_mut(), kernel_pt, display_pid, b"display.elf");
+    if display_entry == 0 { halt(&uart, "display.elf not found"); }
+    let display_tid = kernel_ref().spawn_thread_internal(display_pid)
+        .unwrap_or_else(|| halt(&uart, "display thread failed"));
+    setup_thread(display_tid, display_entry);
+    uart.write_str("k-os: display loaded\n");
+
+    // Done reading from disk — drop the adapter's VirtIO driver
+    let virtio_base = blk.as_ref().map(|b| b.base()).unwrap_or(0);
+    drop(blk);
+
+    // --- Set up VirtIO for storage server ---
+    let storage_pt = kernel_ref().platform_mut().page_table_for(storage_pid);
+    let storage_pt_ref = unsafe { &mut *(storage_pt as *mut mmu::PageTable) };
+
+    // Map VirtIO MMIO into storage's address space
+    mmu::map(storage_pt_ref, mmu::Mapping {
+        va: types::address::VirtualAddress::from_raw(STORAGE_VIRTIO_VA),
+        pa: types::address::PhysicalAddress::from_raw(virtio_base),
+        pages: 1,
+        flags: mmu::Sv39Flags::user_rw(),
+    });
+
+    // Allocate virtqueue pages (2 pages) and map into storage
+    let vqueue_phys = mmu::allocator::alloc_zeroed_page();
+    mmu::allocator::alloc_zeroed_page(); // second page (contiguous)
+    for i in 0..2usize {
+        mmu::map(storage_pt_ref, mmu::Mapping {
+            va: types::address::VirtualAddress::from_raw(STORAGE_VQUEUE_VA + i * 4096),
+            pa: types::address::PhysicalAddress::from_raw(vqueue_phys + i * 4096),
+            pages: 1,
+            flags: mmu::Sv39Flags::user_rw(),
+        });
+    }
+
+    // Allocate request header page and map into storage
+    let reqhdr_phys = mmu::allocator::alloc_zeroed_page();
+    mmu::map(storage_pt_ref, mmu::Mapping {
+        va: types::address::VirtualAddress::from_raw(STORAGE_REQHDR_VA),
+        pa: types::address::PhysicalAddress::from_raw(reqhdr_phys),
+        pages: 1,
+        flags: mmu::Sv39Flags::user_rw(),
+    });
+
+    // Allocate phys info page — storage reads DMA addresses from here
+    let physinfo_phys = mmu::allocator::alloc_zeroed_page();
+    mmu::map(storage_pt_ref, mmu::Mapping {
+        va: types::address::VirtualAddress::from_raw(STORAGE_PHYSINFO_VA),
+        pa: types::address::PhysicalAddress::from_raw(physinfo_phys),
+        pages: 1,
+        flags: mmu::Sv39Flags::user_rw(),
+    });
+    // Write physical addresses: [req_hdr_pa, status_pa, sector_buf_pa]
+    unsafe {
+        let info = physinfo_phys as *mut u64;
+        core::ptr::write_volatile(info, reqhdr_phys as u64);          // req_hdr_pa
+        core::ptr::write_volatile(info.add(1), (reqhdr_phys + 16) as u64); // status_pa
+        core::ptr::write_volatile(info.add(2), (reqhdr_phys + 32) as u64); // sector_buf_pa
+    }
+
+    // Re-initialize VirtIO device with storage's virtqueue
+    reinit_virtio_for_storage(virtio_base, vqueue_phys);
+    uart.write_str("k-os: VirtIO configured for storage\n");
+
+    // --- Set up VirtIO GPU for display server ---
+    let display_pt = kernel_ref().platform_mut().page_table_for(display_pid);
+    let display_pt_ref = unsafe { &mut *(display_pt as *mut mmu::PageTable) };
+
+    if let Some(gpu) = hw::virtio_gpu::VirtioGpu::probe() {
+        let gpu_base = gpu.base();
+
+        // Map GPU MMIO into display's address space
+        mmu::map(display_pt_ref, mmu::Mapping {
+            va: types::address::VirtualAddress::from_raw(DISPLAY_GPU_VA),
+            pa: types::address::PhysicalAddress::from_raw(gpu_base),
+            pages: 1,
+            flags: mmu::Sv39Flags::user_rw(),
         });
 
-    if let Some(ctx) = kern.thread_context_mut(tid) {
-        ctx.set_pc(entry_va);
-        ctx.registers_mut()[2] = INIT_LOAD_VA;
-        let mut sstatus: usize = 0;
-        sstatus |= 1 << 5; // SPIE
-        ctx.set_status(sstatus);
+        // Allocate GPU virtqueue (2 pages)
+        let gpu_vq_phys = mmu::allocator::alloc_zeroed_page();
+        mmu::allocator::alloc_zeroed_page();
+        for i in 0..2usize {
+            mmu::map(display_pt_ref, mmu::Mapping {
+                va: types::address::VirtualAddress::from_raw(DISPLAY_VQUEUE_VA + i * 4096),
+                pa: types::address::PhysicalAddress::from_raw(gpu_vq_phys + i * 4096),
+                pages: 1,
+                flags: mmu::Sv39Flags::user_rw(),
+            });
+        }
+
+        // Allocate command buffer (1 page)
+        let gpu_cmd_phys = mmu::allocator::alloc_zeroed_page();
+        mmu::map(display_pt_ref, mmu::Mapping {
+            va: types::address::VirtualAddress::from_raw(DISPLAY_CMDBUF_VA),
+            pa: types::address::PhysicalAddress::from_raw(gpu_cmd_phys),
+            pages: 1,
+            flags: mmu::Sv39Flags::user_rw(),
+        });
+
+        // Allocate framebuffer (300 pages, contiguous)
+        let fb_phys = mmu::allocator::alloc_zeroed_page();
+        for _ in 1..DISPLAY_FB_PAGES {
+            mmu::allocator::alloc_zeroed_page();
+        }
+        for i in 0..DISPLAY_FB_PAGES {
+            mmu::map(display_pt_ref, mmu::Mapping {
+                va: types::address::VirtualAddress::from_raw(DISPLAY_FB_VA + i * 4096),
+                pa: types::address::PhysicalAddress::from_raw(fb_phys + i * 4096),
+                pages: 1,
+                flags: mmu::Sv39Flags::user_rw(),
+            });
+        }
+
+        // Write phys-info for display server
+        let gpu_physinfo = mmu::allocator::alloc_zeroed_page();
+        mmu::map(display_pt_ref, mmu::Mapping {
+            va: types::address::VirtualAddress::from_raw(DISPLAY_PHYSINFO_VA),
+            pa: types::address::PhysicalAddress::from_raw(gpu_physinfo),
+            pages: 1,
+            flags: mmu::Sv39Flags::user_rw(),
+        });
+        unsafe {
+            let info = gpu_physinfo as *mut u64;
+            core::ptr::write_volatile(info, gpu_cmd_phys as u64);
+            core::ptr::write_volatile(info.add(1), (gpu_cmd_phys + 512) as u64); // response area
+            core::ptr::write_volatile(info.add(2), fb_phys as u64);
+            core::ptr::write_volatile(info.add(3), DISPLAY_FB_WIDTH as u64);
+            core::ptr::write_volatile(info.add(4), DISPLAY_FB_HEIGHT as u64);
+        }
+
+        // Initialize GPU device and set up framebuffer
+        gpu.init_device(gpu_vq_phys);
+        gpu.setup_framebuffer(gpu_cmd_phys, gpu_vq_phys, fb_phys, DISPLAY_FB_WIDTH, DISPLAY_FB_HEIGHT);
+        uart.write_str("k-os: VirtIO GPU configured\n");
+    } else {
+        uart.write_str("k-os: no GPU found (display will be headless)\n");
     }
 
-    uart.write_str("k-os: init loaded, entering U-mode (pid=");
-    uart.write_dec(pid.raw() as usize);
-    uart.write_str(")\n");
+    // --- Allocate shared buffer and map into both processes ---
+    let init_pt = kernel_ref().platform_mut().page_table_for(init_pid);
+    let init_pt_ref = unsafe { &mut *(init_pt as *mut mmu::PageTable) };
 
-    let init_pt_addr = kern.platform_mut().page_table_for(pid);
-    if init_pt_addr != 0 {
-        let pt = unsafe { &*(init_pt_addr as *const mmu::PageTable) };
-        mmu::activate(pt);
+    for i in 0..SHARED_BUF_PAGES {
+        let page = mmu::allocator::alloc_zeroed_page();
+        let va = SHARED_BUF_VA + i * 4096;
+        mmu::map(init_pt_ref, mmu::Mapping {
+            va: types::address::VirtualAddress::from_raw(va),
+            pa: types::address::PhysicalAddress::from_raw(page),
+            pages: 1,
+            flags: mmu::Sv39Flags::user_rw(),
+        });
+        mmu::map(storage_pt_ref, mmu::Mapping {
+            va: types::address::VirtualAddress::from_raw(va),
+            pa: types::address::PhysicalAddress::from_raw(page),
+            pages: 1,
+            flags: mmu::Sv39Flags::user_rw(),
+        });
+    }
+    uart.write_str("k-os: shared buffer mapped\n");
+
+    // --- Grant capabilities ---
+    let all_perms = types::permission::PermissionSet::empty()
+        .with(types::permission::Permission::Read)
+        .with(types::permission::Permission::Write)
+        .with(types::permission::Permission::Execute)
+        .with(types::permission::Permission::Delegate);
+
+    // Create storage endpoint
+    let storage_ep = kernel_ref().create_endpoint()
+        .unwrap_or_else(|_| halt(&uart, "endpoint create failed"));
+
+    // Init caps: slot 0 = ProcessCreate (from boot), slot 1 = Process(storage), slot 2 = Endpoint
+    kernel_ref().grant_capability(
+        init_pid,
+        domain::resource::Resource::Process(storage_pid),
+        all_perms,
+    ).unwrap_or_else(|_| halt(&uart, "grant Process cap failed"));
+    kernel_ref().grant_capability(
+        init_pid,
+        domain::resource::Resource::Endpoint(storage_ep),
+        all_perms,
+    ).unwrap_or_else(|_| halt(&uart, "grant Endpoint to init failed"));
+
+    // Storage caps: slot 0 = Endpoint (Read+Execute for receive/send)
+    let storage_ep_perms = types::permission::PermissionSet::empty()
+        .with(types::permission::Permission::Read)
+        .with(types::permission::Permission::Execute);
+    kernel_ref().grant_capability(
+        storage_pid,
+        domain::resource::Resource::Endpoint(storage_ep),
+        storage_ep_perms,
+    ).unwrap_or_else(|_| halt(&uart, "grant Endpoint to storage failed"));
+
+    // Create display endpoint
+    let display_ep = kernel_ref().create_endpoint()
+        .unwrap_or_else(|_| halt(&uart, "display endpoint failed"));
+
+    // Display caps: slot 0 = Endpoint (Read+Execute)
+    kernel_ref().grant_capability(
+        display_pid,
+        domain::resource::Resource::Endpoint(display_ep),
+        storage_ep_perms, // same Read+Execute
+    ).unwrap_or_else(|_| halt(&uart, "grant Endpoint to display failed"));
+
+    // Init also gets display endpoint (slot 3) and display process cap (slot 4) for IPC
+    kernel_ref().grant_capability(
+        init_pid,
+        domain::resource::Resource::Endpoint(display_ep),
+        all_perms,
+    ).unwrap_or_else(|_| halt(&uart, "grant display ep to init failed"));
+    kernel_ref().grant_capability(
+        init_pid,
+        domain::resource::Resource::Process(display_pid),
+        all_perms,
+    ).unwrap_or_else(|_| halt(&uart, "grant display proc to init failed"));
+
+    uart.write_str("k-os: capabilities granted\n");
+
+    // --- Enter userspace with init, passing shared_buf VA in a0 ---
+    uart.write_str("k-os: entering userspace\n");
+    enter_userspace(init_pid, init_entry, SHARED_BUF_VA);
+}
+
+fn reinit_virtio_for_storage(base: usize, vqueue_phys: usize) {
+    use hw::virtio_blk::{mmio_read, mmio_write};
+
+    // Reset
+    mmio_write(base, 0x070, 0);
+    while mmio_read(base, 0x070) != 0 {}
+
+    // Acknowledge + Driver
+    mmio_write(base, 0x070, 1); // ACK
+    mmio_write(base, 0x070, mmio_read(base, 0x070) | 2); // DRIVER
+
+    // Legacy: set guest page size
+    mmio_write(base, 0x028, 4096);
+
+    // Features: accept none
+    mmio_write(base, 0x014, 0);
+    mmio_write(base, 0x024, 0);
+    mmio_write(base, 0x020, 0);
+
+    // Queue 0 setup
+    mmio_write(base, 0x030, 0); // select queue 0
+    let queue_max = mmio_read(base, 0x034);
+    let queue_num = 8u32.min(queue_max);
+    mmio_write(base, 0x038, queue_num);
+
+    // Point device to storage's virtqueue (physical page number)
+    mmio_write(base, 0x040, (vqueue_phys / 4096) as u32);
+
+    // DRIVER_OK
+    mmio_write(base, 0x070, mmio_read(base, 0x070) | 4);
+}
+
+fn load_elf_into_process(
+    _uart: &Uart,
+    blk: Option<&mut hw::virtio_blk::VirtioBlk>,
+    kernel_pt: &mmu::PageTable,
+    pid: ProcessId,
+    filename: &[u8],
+) -> usize {
+    let buf_base = mmu::allocator::alloc_zeroed_page();
+    let file_pages = MAX_FILE_SIZE / 4096;
+    for _ in 1..file_pages {
+        mmu::allocator::alloc_zeroed_page();
+    }
+    let buf = unsafe { core::slice::from_raw_parts_mut(buf_base as *mut u8, MAX_FILE_SIZE) };
+
+    let file_size = match blk {
+        Some(b) => boot_fs::read_file_from_disk(b, filename, buf).unwrap_or(0),
+        None => 0,
+    };
+    if file_size == 0 { return 0; }
+
+    let elf_info = match elf::parse(&buf[..file_size]) {
+        Ok(info) => info,
+        Err(_) => return 0,
+    };
+
+    let user_pt = mmu::create_user_page_table(
+        kernel_pt,
+        types::address::PhysicalAddress::from_raw(0),
+        0,
+        types::address::VirtualAddress::from_raw(USER_VA_BASE),
+    );
+
+    for segment in elf_info.segments() {
+        let page_start = segment.vaddr & !0xFFF;
+        let offset_in_page = segment.vaddr & 0xFFF;
+        let total_size = offset_in_page + segment.mem_size;
+        let seg_pages = (total_size + 4095) / 4096;
+
+        for p in 0..seg_pages {
+            let page = mmu::allocator::alloc_zeroed_page();
+            let page_va = page_start + p * 4096;
+            let seg_file_start = if p == 0 { 0 } else { p * 4096 - offset_in_page };
+            let dest_off = if p == 0 { offset_in_page } else { 0 };
+            let copy_len = if seg_file_start < segment.file_size {
+                (segment.file_size - seg_file_start).min(4096 - dest_off)
+            } else { 0 };
+
+            if copy_len > 0 {
+                let src = segment.file_offset + seg_file_start;
+                if src + copy_len <= file_size {
+                    unsafe {
+                        core::ptr::copy_nonoverlapping(
+                            buf.as_ptr().add(src),
+                            (page as *mut u8).add(dest_off),
+                            copy_len,
+                        );
+                    }
+                }
+            }
+
+            let flags = if segment.flags.execute {
+                mmu::Sv39Flags::user_rx()
+            } else if segment.flags.write {
+                mmu::Sv39Flags::user_rw()
+            } else {
+                mmu::Sv39Flags::user_rx()
+            };
+            mmu::map(user_pt, mmu::Mapping {
+                va: types::address::VirtualAddress::from_raw(page_va),
+                pa: types::address::PhysicalAddress::from_raw(page),
+                pages: 1,
+                flags,
+            });
+        }
+    }
+
+    // Stack: 4 pages below USER_VA_BASE
+    for i in 0..4usize {
+        let sp = mmu::allocator::alloc_zeroed_page();
+        mmu::map(user_pt, mmu::Mapping {
+            va: types::address::VirtualAddress::from_raw(USER_VA_BASE - (4 - i) * 4096),
+            pa: types::address::PhysicalAddress::from_raw(sp),
+            pages: 1,
+            flags: mmu::Sv39Flags::user_rw(),
+        });
+    }
+
+    kernel_ref().platform_mut().set_page_table(pid, user_pt as *const mmu::PageTable as usize);
+    elf_info.entry_point
+}
+
+fn setup_thread(tid: ThreadId, entry: usize) {
+    if let Some(ctx) = kernel_ref().thread_context_mut(tid) {
+        ctx.set_pc(entry);
+        ctx.registers_mut()[2] = USER_VA_BASE;
+        ctx.set_status(1 << 5);
+    }
+}
+
+fn enter_userspace(pid: ProcessId, entry: usize, a0: usize) -> ! {
+    let kern = kernel_ref();
+    let pt_addr = kern.platform_mut().page_table_for(pid);
+    if pt_addr != 0 {
+        mmu::activate(unsafe { &*(pt_addr as *const mmu::PageTable) });
     }
 
     let kernel_sp: usize;
     unsafe { core::arch::asm!("mv {0}, sp", out(reg) kernel_sp) };
     trap::set_kernel_stack(kernel_sp);
 
-    let user_sp = INIT_LOAD_VA;
     unsafe {
         core::arch::asm!(
             "csrc sstatus, {spp}",
             "csrs sstatus, {spie}",
             "csrw sepc, {entry}",
             "mv sp, {stack}",
+            "mv a0, {arg}",
             "sret",
             spp = in(reg) 1usize << 8,
             spie = in(reg) 1usize << 5,
-            entry = in(reg) entry_va,
-            stack = in(reg) user_sp,
+            entry = in(reg) entry,
+            stack = in(reg) USER_VA_BASE,
+            arg = in(reg) a0,
             options(noreturn),
         );
     }
 }
 
+fn halt(uart: &Uart, msg: &str) -> ! {
+    uart.write_str("k-os: FATAL — ");
+    uart.write_str(msg);
+    uart.put_char(b'\n');
+    loop { unsafe { core::arch::asm!("wfi") }; }
+}
+
 #[panic_handler]
 fn panic(info: &core::panic::PanicInfo) -> ! {
     let uart = Uart::new();
@@ -310,7 +523,5 @@ fn panic(info: &core::panic::PanicInfo) -> ! {
         uart.write_dec(location.line() as usize);
     }
     uart.put_char(b'\n');
-    loop {
-        unsafe { core::arch::asm!("wfi") };
-    }
+    loop { unsafe { core::arch::asm!("wfi") }; }
 }

crates/adapter-riscv/src/mmu/mod.rs

@@ -2,4 +2,4 @@ pub mod allocator;
 pub mod page_table;
 
 pub use allocator::init_allocator;
-pub use page_table::{activate, init_kernel_page_table, create_user_page_table, map, Sv39Flags, Mapping, PageTable, PAGE_SIZE};
+pub use page_table::{activate, init_kernel_page_table, create_user_page_table, map, translate, Sv39Flags, Mapping, PageTable, PAGE_SIZE};

crates/adapter-riscv/src/mmu/page_table.rs

@@ -92,6 +92,21 @@ fn vpn(va: usize, level: usize) -> usize {
     (va >> (12 + 9 * level)) & 0x1FF
 }
 
+pub fn translate(root: &PageTable, va: usize) -> Option<usize> {
+    let vpn2 = vpn(va, 2);
+    if !root.entries[vpn2].is_valid() { return None; }
+    let l1 = unsafe { &*((root.entries[vpn2].ppn() << 12) as *const PageTable) };
+
+    let vpn1 = vpn(va, 1);
+    if !l1.entries[vpn1].is_valid() { return None; }
+    let l0 = unsafe { &*((l1.entries[vpn1].ppn() << 12) as *const PageTable) };
+
+    let vpn0 = vpn(va, 0);
+    if !l0.entries[vpn0].is_valid() { return None; }
+    let pa = (l0.entries[vpn0].ppn() << 12) as usize | (va & 0xFFF);
+    Some(pa)
+}
+
 fn map_page(root: &mut PageTable, va: usize, pa: usize, flags: Sv39Flags) {
     let vpn2 = vpn(va, 2);
     let vpn1 = vpn(va, 1);
@@ -163,36 +178,32 @@ pub fn activate(root: &PageTable) {
 
 pub fn create_user_page_table(
     kernel_root: &PageTable,
-    program_pa: PhysicalAddress,
-    program_pages: usize,
-    user_va: VirtualAddress,
+    _program_pa: PhysicalAddress,
+    _program_pages: usize,
+    _user_va: VirtualAddress,
 ) -> &'static mut PageTable {
     let root = alloc_page_table();
 
     for i in 0..512 {
-        if kernel_root.entries[i].is_valid() {
+        if !kernel_root.entries[i].is_valid() {
+            continue;
+        }
+        if i == 0 {
+            // User mappings land in VPN[2]=0 — each process needs its own L1
+            let kernel_l1_addr = (kernel_root.entries[i].ppn() << 12) as *const PageTable;
+            let kernel_l1 = unsafe { &*kernel_l1_addr };
+            let new_l1 = alloc_page_table();
+            for j in 0..512 {
+                if kernel_l1.entries[j].is_valid() {
+                    new_l1.entries[j] = kernel_l1.entries[j];
+                }
+            }
+            let ppn = (new_l1 as *const PageTable as u64) >> 12;
+            root.entries[i] = PageTableEntry::new_branch(ppn);
+        } else {
             root.entries[i] = kernel_root.entries[i];
         }
     }
 
-    if program_pages > 0 {
-        map(root, Mapping {
-            va: user_va,
-            pa: program_pa,
-            pages: program_pages,
-            flags: Sv39Flags::user_rx(),
-        });
-
-        let stack_table = alloc_page_table();
-        let stack_pa = PhysicalAddress::from_raw(stack_table as *const PageTable as usize);
-        let stack_va = VirtualAddress::from_raw(user_va.raw().wrapping_sub(PAGE_SIZE));
-        map(root, Mapping {
-            va: stack_va,
-            pa: stack_pa,
-            pages: 1,
-            flags: Sv39Flags::user_rw(),
-        });
-    }
-
     root
 }

crates/adapter-riscv/src/platform.rs

@@ -16,14 +16,17 @@ use crate::trap;
 
 pub struct RiscVPlatform {
     num_cores: u8,
+    kernel_pt: usize,
     page_tables: [usize; MAX_PROCESSES],
 }
 
 impl RiscVPlatform {
     pub fn new(kernel_pt_addr: usize) -> Self {
-        let mut pt = [0usize; MAX_PROCESSES];
-        pt[0] = kernel_pt_addr;
-        Self { num_cores: 1, page_tables: pt }
+        Self {
+            num_cores: 1,
+            kernel_pt: kernel_pt_addr,
+            page_tables: [0usize; MAX_PROCESSES],
+        }
     }
 
     pub fn page_table_for(&self, pid: ProcessId) -> usize {
@@ -37,7 +40,7 @@ impl RiscVPlatform {
     fn ensure_page_table(&mut self, pid: ProcessId) -> &mut mmu::PageTable {
         let idx = pid.raw() as usize;
         if self.page_tables[idx] == 0 {
-            let kernel_pt = unsafe { &*(self.page_tables[0] as *const mmu::PageTable) };
+            let kernel_pt = unsafe { &*(self.kernel_pt as *const mmu::PageTable) };
             let user_pt = mmu::create_user_page_table(
                 kernel_pt,
                 PhysicalAddress::from_raw(0),
@@ -131,6 +134,28 @@ impl Platform for RiscVPlatform {
         });
     }
 
+    fn debug_putchar(&self, byte: u8) {
+        crate::hw::uart::Uart::new().put_char(byte);
+    }
+
+    fn translate_va(&self, process: ProcessId, va: VirtualAddress) -> Option<PhysicalAddress> {
+        let pt_addr = self.page_tables[process.raw() as usize];
+        if pt_addr == 0 { return None; }
+        let pt = unsafe { &*(pt_addr as *const mmu::PageTable) };
+        mmu::translate(pt, va.raw()).map(PhysicalAddress::from_raw)
+    }
+
+    fn map_user_page(&mut self, process: ProcessId, va: VirtualAddress, pa: PhysicalAddress, writable: bool, executable: bool) {
+        let pt = self.ensure_page_table(process);
+        let flags = mmu::Sv39Flags::user(true, writable, executable);
+        mmu::map(pt, mmu::Mapping {
+            va,
+            pa,
+            pages: 1,
+            flags,
+        });
+    }
+
     fn halt(&self) -> ! {
         unsafe {
             core::arch::asm!(

crates/adapter-riscv/src/trap/mod.rs

@@ -135,7 +135,7 @@ pub fn init() {
         let addr = trap_vector as usize;
         core::arch::asm!("csrw stvec, {0}", in(reg) addr);
         core::arch::asm!("csrw sscratch, zero");
-        core::arch::asm!("csrs sstatus, {0}", in(reg) 1usize << 1);
+        // SIE stays clear — interrupts are enabled only when entering userspace via sret
         let sie_bits = (1usize << 5) | (1usize << 9) | (1usize << 1);
         core::arch::asm!("csrs sie, {0}", in(reg) sie_bits);
     }
@@ -230,6 +230,25 @@ fn decode_syscall(frame: &TrapFrame) -> Option<domain::syscall::Syscall> {
                 count,
             })
         }
+        SYS_SPAWN_THREAD_IN => {
+            let slot = types::bounded::CapSlot::new(a0 as u8)?;
+            Some(Syscall::SpawnThreadIn {
+                process: slot,
+                entry: types::address::EntryPoint::from_raw(a1),
+                stack: types::address::StackPointer::from_raw(a2),
+            })
+        }
+        SYS_CREATE_ENDPOINT => Some(Syscall::CreateEndpoint),
+        SYS_DEBUG_PUTCHAR => Some(Syscall::DebugPutchar { byte: a0 as u8 }),
+        SYS_MAP_PAGE => {
+            let slot = types::bounded::CapSlot::new(a0 as u8)?;
+            Some(Syscall::MapPage {
+                process: slot,
+                src_va: types::address::VirtualAddress::from_raw(a1),
+                dst_va: types::address::VirtualAddress::from_raw(a2),
+                executable: a3 != 0,
+            })
+        }
         _ => None,
     }
 }
@@ -272,6 +291,30 @@ fn load_context_to_frame(ctx: &domain::thread::SavedContext, frame: &mut TrapFra
     frame.sstatus |= 1 << 5;    // set SPIE
 }
 
+fn apply_pending_result(frame: &mut TrapFrame, tid: types::id::ThreadId) {
+    let kern = crate::kernel_ref();
+    if let Some(result) = kern.take_pending_result(tid) {
+        write_result_direct(frame, &result);
+    }
+}
+
+fn write_result_direct(frame: &mut TrapFrame, result: &kernel::SyscallResult) {
+    use kernel::SyscallResult;
+    match result {
+        SyscallResult::Ok => frame.regs[10] = 0,
+        SyscallResult::Value(v) => frame.regs[10] = *v,
+        SyscallResult::Slot(s) => frame.regs[10] = s.value() as usize,
+        SyscallResult::Message(m) => {
+            frame.regs[10] = m.word(0);
+            frame.regs[11] = m.word(1);
+            frame.regs[12] = m.word(2);
+            frame.regs[13] = m.word(3);
+        }
+        SyscallResult::Error(_) => frame.regs[10] = usize::MAX,
+        SyscallResult::WakeReason(_) => frame.regs[10] = 0,
+    }
+}
+
 fn switch_to_thread(frame: &mut TrapFrame, current_tid: types::id::ThreadId, next_tid: types::id::ThreadId) {
     let kern = crate::kernel_ref();
 
@@ -286,6 +329,8 @@ fn switch_to_thread(frame: &mut TrapFrame, current_tid: types::id::ThreadId, nex
         load_context_to_frame(ctx, frame);
     }
 
+    apply_pending_result(frame, next_tid);
+
     if next_pid != current_pid {
         if let Some(pid) = next_pid {
             let pt_addr = kern.platform_mut().page_table_for(pid);
@@ -308,10 +353,15 @@ fn switch_to_next(frame: &mut TrapFrame, current_tid: types::id::ThreadId) {
         let next_pid = kern.thread_process(next_tid);
         let current_pid = kern.thread_process(current_tid);
 
+        let core = types::id::CoreId::from_raw(0);
+        let _ = kern.set_thread_running(next_tid, core);
+
         if let Some(ctx) = kern.thread_context(next_tid) {
             load_context_to_frame(ctx, frame);
         }
 
+        apply_pending_result(frame, next_tid);
+
         if next_pid != current_pid {
             if let Some(pid) = next_pid {
                 let pt_addr = kern.platform_mut().page_table_for(pid);
@@ -322,7 +372,6 @@ fn switch_to_next(frame: &mut TrapFrame, current_tid: types::id::ThreadId) {
             }
         }
     } else {
-        // no runnable thread — idle
         loop { unsafe { core::arch::asm!("wfi") }; }
     }
 }