feat: proper IPC-based boot — init loads servers from storage via IPC, VirtIO GPU driver

Complete microkernel boot pipeline: adapter loads only init + storage + display
from disk. Init bootstraps all other servers by reading binaries from the
storage server via IPC, parsing ELF, creating processes, mapping pages, and
spawning threads.

New syscalls:
- CreateEndpoint: userspace endpoint creation with full capability grant
- DebugPutchar: debug output to UART from userspace
- MapPage: cross-process page mapping (init loads binaries into children)
- SpawnThreadIn: spawn thread in another process via capability

Key fixes:
- Per-process L1 page tables for VPN[2]=0 (prevents cross-process corruption)
- Separate kernel_pt from page_tables[0] (init pid=0 overwrote kernel PT ref)
- Thread Running state set in switch_to_next (syscalls rejected without it)
- Pending IPC results applied during context switch
- SIE disabled during boot (timer can't preempt into unready processes)
- User heap VA starts at 0x40000 (avoids shared buffer at 0x30000)
- RequestPages maps at user VAs via per-process heap allocator

VirtIO GPU:
- Adapter probes for GPU device, initializes resource/scanout/backing
- Display server writes to mapped framebuffer, flushes via GPU virtqueue
- 640x480 BGRA framebuffer with transfer-to-host and resource-flush

Storage server:
- Userspace VirtIO block driver using pre-mapped MMIO and DMA pages
- FAT16 filesystem reader serving file-read requests via IPC
- Shared buffer protocol: init writes filename, storage writes file data

Echo app for IPC testing (adapter-loaded echo proved the pipeline end-to-end).

crates/servers/storage-server/src/adapters/mod.rs

@@ -1,2 +1,3 @@
 pub mod mock_block;
 pub mod mock_fs;
+pub mod virtio_blk;

crates/servers/storage-server/src/adapters/virtio_blk.rs

@@ -0,0 +1,183 @@
+use crate::block_device::{BlockDevice, SectorId};
+
+const QUEUE_SIZE: usize = 8;
+const SECTOR_SIZE: usize = 512;
+
+const MMIO_BASE: usize = 0x20000;
+const VQUEUE_VA: usize = 0x21000;
+const REQ_HDR_VA: usize = 0x23000;
+
+// Physical addresses are written to a known location by the adapter at boot
+// Layout at 0x24000: [req_hdr_pa: u64, status_pa: u64, sector_buf_pa: u64]
+const PHYS_INFO_VA: usize = 0x24000;
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct VirtqDesc {
+    addr: u64,
+    len: u32,
+    flags: u16,
+    next: u16,
+}
+
+#[repr(C)]
+struct VirtqAvail {
+    flags: u16,
+    idx: u16,
+    ring: [u16; QUEUE_SIZE],
+    used_event: u16,
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct VirtqUsedElem {
+    id: u32,
+    len: u32,
+}
+
+#[repr(C)]
+struct VirtqUsed {
+    flags: u16,
+    idx: u16,
+    ring: [VirtqUsedElem; QUEUE_SIZE],
+}
+
+#[repr(C)]
+struct VirtioBlkReqHeader {
+    req_type: u32,
+    reserved: u32,
+    sector: u64,
+}
+
+fn mmio_read(offset: usize) -> u32 {
+    unsafe { core::ptr::read_volatile((MMIO_BASE + offset) as *const u32) }
+}
+
+fn mmio_write(offset: usize, val: u32) {
+    unsafe { core::ptr::write_volatile((MMIO_BASE + offset) as *mut u32, val) }
+}
+
+fn descs() -> *mut VirtqDesc {
+    VQUEUE_VA as *mut VirtqDesc
+}
+
+fn avail() -> *mut VirtqAvail {
+    (VQUEUE_VA + QUEUE_SIZE * 16) as *mut VirtqAvail
+}
+
+fn used() -> *mut VirtqUsed {
+    (VQUEUE_VA + 0x1000) as *mut VirtqUsed
+}
+
+fn req_header() -> *mut VirtioBlkReqHeader {
+    REQ_HDR_VA as *mut VirtioBlkReqHeader
+}
+
+fn req_status() -> *mut u8 {
+    (REQ_HDR_VA + 16) as *mut u8
+}
+
+struct PhysAddrs {
+    req_hdr: u64,
+    status: u64,
+    sector_buf: u64,
+}
+
+fn read_phys_addrs() -> PhysAddrs {
+    unsafe {
+        let base = PHYS_INFO_VA as *const u64;
+        PhysAddrs {
+            req_hdr: core::ptr::read_volatile(base),
+            status: core::ptr::read_volatile(base.add(1)),
+            sector_buf: core::ptr::read_volatile(base.add(2)),
+        }
+    }
+}
+
+pub struct VirtioBlockDevice {
+    phys: PhysAddrs,
+}
+
+impl VirtioBlockDevice {
+    pub fn new() -> Self {
+        Self { phys: read_phys_addrs() }
+    }
+}
+
+impl BlockDevice for VirtioBlockDevice {
+    fn sector_size(&self) -> usize {
+        SECTOR_SIZE
+    }
+
+    fn sector_count(&self) -> usize {
+        0xFFFF
+    }
+
+    fn read_sector(&mut self, sector: SectorId, buf: &mut [u8]) -> bool {
+        if buf.len() < SECTOR_SIZE { return false; }
+
+        // Write to the local VA — device reads via physical address
+        unsafe {
+            let hdr = req_header();
+            (*hdr).req_type = 0;
+            (*hdr).reserved = 0;
+            (*hdr).sector = sector.raw() as u64;
+
+            core::ptr::write_volatile(req_status(), 0xFF);
+
+            // Sector buffer: use a fixed area at REQ_HDR_VA + 32
+            let sector_buf_va = (REQ_HDR_VA + 32) as *mut u8;
+
+            let d = descs();
+            (*d.add(0)) = VirtqDesc {
+                addr: self.phys.req_hdr,
+                len: 16,
+                flags: 1,
+                next: 1,
+            };
+            (*d.add(1)) = VirtqDesc {
+                addr: self.phys.sector_buf,
+                len: SECTOR_SIZE as u32,
+                flags: 2 | 1,
+                next: 2,
+            };
+            (*d.add(2)) = VirtqDesc {
+                addr: self.phys.status,
+                len: 1,
+                flags: 2,
+                next: 0,
+            };
+
+            let a = avail();
+            let avail_idx = core::ptr::read_volatile(&(*a).idx);
+            (*a).ring[(avail_idx as usize) % QUEUE_SIZE] = 0;
+            core::sync::atomic::fence(core::sync::atomic::Ordering::SeqCst);
+            core::ptr::write_volatile(&mut (*a).idx, avail_idx.wrapping_add(1));
+            core::sync::atomic::fence(core::sync::atomic::Ordering::SeqCst);
+
+            mmio_write(0x050, 0);
+
+            let expected = avail_idx.wrapping_add(1);
+            let u = used();
+            let mut timeout = 10_000_000u32;
+            while core::ptr::read_volatile(&(*u).idx) != expected {
+                core::hint::spin_loop();
+                timeout -= 1;
+                if timeout == 0 { return false; }
+            }
+
+            if core::ptr::read_volatile(req_status()) != 0 {
+                return false;
+            }
+
+            // Copy from sector buffer VA to caller's buffer
+            core::ptr::copy_nonoverlapping(sector_buf_va, buf.as_mut_ptr(), SECTOR_SIZE);
+        }
+
+        true
+    }
+
+    fn write_sector(&mut self, _sector: SectorId, _buf: &[u8]) -> bool {
+        false
+    }
+}