feat: proper IPC-based boot — init loads servers from storage via IPC, VirtIO GPU driver

Complete microkernel boot pipeline: adapter loads only init + storage + display
from disk. Init bootstraps all other servers by reading binaries from the
storage server via IPC, parsing ELF, creating processes, mapping pages, and
spawning threads.

New syscalls:
- CreateEndpoint: userspace endpoint creation with full capability grant
- DebugPutchar: debug output to UART from userspace
- MapPage: cross-process page mapping (init loads binaries into children)
- SpawnThreadIn: spawn thread in another process via capability

Key fixes:
- Per-process L1 page tables for VPN[2]=0 (prevents cross-process corruption)
- Separate kernel_pt from page_tables[0] (init pid=0 overwrote kernel PT ref)
- Thread Running state set in switch_to_next (syscalls rejected without it)
- Pending IPC results applied during context switch
- SIE disabled during boot (timer can't preempt into unready processes)
- User heap VA starts at 0x40000 (avoids shared buffer at 0x30000)
- RequestPages maps at user VAs via per-process heap allocator

VirtIO GPU:
- Adapter probes for GPU device, initializes resource/scanout/backing
- Display server writes to mapped framebuffer, flushes via GPU virtqueue
- 640x480 BGRA framebuffer with transfer-to-host and resource-flush

Storage server:
- Userspace VirtIO block driver using pre-mapped MMIO and DMA pages
- FAT16 filesystem reader serving file-read requests via IPC
- Shared buffer protocol: init writes filename, storage writes file data

Echo app for IPC testing (adapter-loaded echo proved the pipeline end-to-end).

crates/servers/storage-server/src/adapters/mod.rs

@@ -1,2 +1,3 @@
 pub mod mock_block;
 pub mod mock_fs;
+pub mod virtio_blk;

crates/servers/storage-server/src/adapters/virtio_blk.rs

@@ -0,0 +1,183 @@
+use crate::block_device::{BlockDevice, SectorId};
+
+const QUEUE_SIZE: usize = 8;
+const SECTOR_SIZE: usize = 512;
+
+const MMIO_BASE: usize = 0x20000;
+const VQUEUE_VA: usize = 0x21000;
+const REQ_HDR_VA: usize = 0x23000;
+
+// Physical addresses are written to a known location by the adapter at boot
+// Layout at 0x24000: [req_hdr_pa: u64, status_pa: u64, sector_buf_pa: u64]
+const PHYS_INFO_VA: usize = 0x24000;
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct VirtqDesc {
+    addr: u64,
+    len: u32,
+    flags: u16,
+    next: u16,
+}
+
+#[repr(C)]
+struct VirtqAvail {
+    flags: u16,
+    idx: u16,
+    ring: [u16; QUEUE_SIZE],
+    used_event: u16,
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct VirtqUsedElem {
+    id: u32,
+    len: u32,
+}
+
+#[repr(C)]
+struct VirtqUsed {
+    flags: u16,
+    idx: u16,
+    ring: [VirtqUsedElem; QUEUE_SIZE],
+}
+
+#[repr(C)]
+struct VirtioBlkReqHeader {
+    req_type: u32,
+    reserved: u32,
+    sector: u64,
+}
+
+fn mmio_read(offset: usize) -> u32 {
+    unsafe { core::ptr::read_volatile((MMIO_BASE + offset) as *const u32) }
+}
+
+fn mmio_write(offset: usize, val: u32) {
+    unsafe { core::ptr::write_volatile((MMIO_BASE + offset) as *mut u32, val) }
+}
+
+fn descs() -> *mut VirtqDesc {
+    VQUEUE_VA as *mut VirtqDesc
+}
+
+fn avail() -> *mut VirtqAvail {
+    (VQUEUE_VA + QUEUE_SIZE * 16) as *mut VirtqAvail
+}
+
+fn used() -> *mut VirtqUsed {
+    (VQUEUE_VA + 0x1000) as *mut VirtqUsed
+}
+
+fn req_header() -> *mut VirtioBlkReqHeader {
+    REQ_HDR_VA as *mut VirtioBlkReqHeader
+}
+
+fn req_status() -> *mut u8 {
+    (REQ_HDR_VA + 16) as *mut u8
+}
+
+struct PhysAddrs {
+    req_hdr: u64,
+    status: u64,
+    sector_buf: u64,
+}
+
+fn read_phys_addrs() -> PhysAddrs {
+    unsafe {
+        let base = PHYS_INFO_VA as *const u64;
+        PhysAddrs {
+            req_hdr: core::ptr::read_volatile(base),
+            status: core::ptr::read_volatile(base.add(1)),
+            sector_buf: core::ptr::read_volatile(base.add(2)),
+        }
+    }
+}
+
+pub struct VirtioBlockDevice {
+    phys: PhysAddrs,
+}
+
+impl VirtioBlockDevice {
+    pub fn new() -> Self {
+        Self { phys: read_phys_addrs() }
+    }
+}
+
+impl BlockDevice for VirtioBlockDevice {
+    fn sector_size(&self) -> usize {
+        SECTOR_SIZE
+    }
+
+    fn sector_count(&self) -> usize {
+        0xFFFF
+    }
+
+    fn read_sector(&mut self, sector: SectorId, buf: &mut [u8]) -> bool {
+        if buf.len() < SECTOR_SIZE { return false; }
+
+        // Write to the local VA — device reads via physical address
+        unsafe {
+            let hdr = req_header();
+            (*hdr).req_type = 0;
+            (*hdr).reserved = 0;
+            (*hdr).sector = sector.raw() as u64;
+
+            core::ptr::write_volatile(req_status(), 0xFF);
+
+            // Sector buffer: use a fixed area at REQ_HDR_VA + 32
+            let sector_buf_va = (REQ_HDR_VA + 32) as *mut u8;
+
+            let d = descs();
+            (*d.add(0)) = VirtqDesc {
+                addr: self.phys.req_hdr,
+                len: 16,
+                flags: 1,
+                next: 1,
+            };
+            (*d.add(1)) = VirtqDesc {
+                addr: self.phys.sector_buf,
+                len: SECTOR_SIZE as u32,
+                flags: 2 | 1,
+                next: 2,
+            };
+            (*d.add(2)) = VirtqDesc {
+                addr: self.phys.status,
+                len: 1,
+                flags: 2,
+                next: 0,
+            };
+
+            let a = avail();
+            let avail_idx = core::ptr::read_volatile(&(*a).idx);
+            (*a).ring[(avail_idx as usize) % QUEUE_SIZE] = 0;
+            core::sync::atomic::fence(core::sync::atomic::Ordering::SeqCst);
+            core::ptr::write_volatile(&mut (*a).idx, avail_idx.wrapping_add(1));
+            core::sync::atomic::fence(core::sync::atomic::Ordering::SeqCst);
+
+            mmio_write(0x050, 0);
+
+            let expected = avail_idx.wrapping_add(1);
+            let u = used();
+            let mut timeout = 10_000_000u32;
+            while core::ptr::read_volatile(&(*u).idx) != expected {
+                core::hint::spin_loop();
+                timeout -= 1;
+                if timeout == 0 { return false; }
+            }
+
+            if core::ptr::read_volatile(req_status()) != 0 {
+                return false;
+            }
+
+            // Copy from sector buffer VA to caller's buffer
+            core::ptr::copy_nonoverlapping(sector_buf_va, buf.as_mut_ptr(), SECTOR_SIZE);
+        }
+
+        true
+    }
+
+    fn write_sector(&mut self, _sector: SectorId, _buf: &[u8]) -> bool {
+        false
+    }
+}

crates/servers/storage-server/src/lib.rs

@@ -11,16 +11,81 @@ pub mod server;
 #[path = "tests/mod.rs"]
 mod tests;
 
+use userspace::syscall;
+
+const CMD_READ_FILE: usize = 1;
+const SHARED_BUF_VA: usize = 0x30000;
+const SHARED_BUF_SIZE: usize = 64 * 1024;
+
+fn shared_buf() -> &'static mut [u8] {
+    unsafe { core::slice::from_raw_parts_mut(SHARED_BUF_VA as *mut u8, SHARED_BUF_SIZE) }
+}
+
+fn debug_print(s: &[u8]) {
+    for &b in s {
+        syscall::debug_putchar(b);
+    }
+}
+
 pub fn run() -> ! {
-    #[cfg(feature = "qemu-virt")]
-    {
-        let device = adapters::mock_block::MockBlockDevice::new(64);
-        let filesystem = fs::fat16::Fat16::mount(device);
-        if let Some(mut fs) = filesystem {
-            let mut srv = server::StorageServer::new(fs);
-            server_framework::serve(&mut srv, 0);
+    debug_print(b"storage: started\n");
+
+    let device = adapters::virtio_blk::VirtioBlockDevice::new();
+    let fat16 = fs::fat16::Fat16::mount(device);
+    if fat16.is_none() {
+        debug_print(b"storage: FAT16 mount failed\n");
+        loop { syscall::yield_now(); }
+    }
+    let mut fat16 = fat16.unwrap();
+    debug_print(b"storage: FAT16 mounted\n");
+
+    let ep: usize = 0;
+
+    loop {
+        let (w0, w1, _w2, _w3) = syscall::receive(ep);
+
+        match w0 {
+            CMD_READ_FILE => {
+                let filename_len = w1;
+                let buf = shared_buf();
+                let filename_len = filename_len.min(buf.len());
+
+                let mut name_buf = [0u8; 32];
+                let name_len = filename_len.min(32);
+                name_buf[..name_len].copy_from_slice(&buf[..name_len]);
+
+                debug_print(b"storage: read ");
+                debug_print(&name_buf[..name_len]);
+                debug_print(b"...");
+
+                let file_size = read_entire_file(&mut fat16, &name_buf[..name_len], buf);
+
+                debug_print(if file_size > 0 { b"ok\n" } else { b"NOT FOUND\n" });
+
+                syscall::send(ep, file_size, 0, 0, 0);
+            }
+            _ => {
+                syscall::send(ep, 0, 0, 0, 0);
+            }
         }
     }
-
-    loop { userspace::syscall::yield_now(); }
+}
+
+fn read_entire_file<B: block_device::BlockDevice>(
+    fat: &mut fs::fat16::Fat16<B>,
+    filename: &[u8],
+    out: &mut [u8],
+) -> usize {
+    use filesystem::FileSystem;
+
+    let handle = match fat.open(filename) {
+        Some(h) => h,
+        None => return 0,
+    };
+
+    let size = fat.file_size(handle).unwrap_or(0);
+    let to_read = size.min(out.len());
+    let read = fat.read(handle, &mut out[..to_read]).unwrap_or(0);
+    fat.close(handle);
+    read
 }