feat: proper IPC-based boot — init loads servers from storage via IPC, VirtIO GPU driver

Complete microkernel boot pipeline: adapter loads only init + storage + display
from disk. Init bootstraps all other servers by reading binaries from the
storage server via IPC, parsing ELF, creating processes, mapping pages, and
spawning threads.

New syscalls:
- CreateEndpoint: userspace endpoint creation with full capability grant
- DebugPutchar: debug output to UART from userspace
- MapPage: cross-process page mapping (init loads binaries into children)
- SpawnThreadIn: spawn thread in another process via capability

Key fixes:
- Per-process L1 page tables for VPN[2]=0 (prevents cross-process corruption)
- Separate kernel_pt from page_tables[0] (init pid=0 overwrote kernel PT ref)
- Thread Running state set in switch_to_next (syscalls rejected without it)
- Pending IPC results applied during context switch
- SIE disabled during boot (timer can't preempt into unready processes)
- User heap VA starts at 0x40000 (avoids shared buffer at 0x30000)
- RequestPages maps at user VAs via per-process heap allocator

VirtIO GPU:
- Adapter probes for GPU device, initializes resource/scanout/backing
- Display server writes to mapped framebuffer, flushes via GPU virtqueue
- 640x480 BGRA framebuffer with transfer-to-host and resource-flush

Storage server:
- Userspace VirtIO block driver using pre-mapped MMIO and DMA pages
- FAT16 filesystem reader serving file-read requests via IPC
- Shared buffer protocol: init writes filename, storage writes file data

Echo app for IPC testing (adapter-loaded echo proved the pipeline end-to-end).

crates/userspace/src/arch/mock.rs

@@ -10,6 +10,14 @@ pub fn syscall2(_nr: usize, _a0: usize, _a1: usize) -> usize {
     0
 }
 
+pub fn syscall3(_nr: usize, _a0: usize, _a1: usize, _a2: usize) -> usize {
+    0
+}
+
+pub fn syscall4(_nr: usize, _a0: usize, _a1: usize, _a2: usize, _a3: usize) -> usize {
+    0
+}
+
 pub fn syscall5(_nr: usize, _a0: usize, _a1: usize, _a2: usize, _a3: usize, _a4: usize) -> usize {
     0
 }

crates/userspace/src/arch/riscv.rs

@@ -38,6 +38,37 @@ pub fn syscall2(nr: usize, a0: usize, a1: usize) -> usize {
     ret
 }
 
+#[inline(always)]
+pub fn syscall3(nr: usize, a0: usize, a1: usize, a2: usize) -> usize {
+    let ret: usize;
+    unsafe {
+        core::arch::asm!(
+            "ecall",
+            in("a7") nr,
+            inlateout("a0") a0 => ret,
+            in("a1") a1,
+            in("a2") a2,
+        );
+    }
+    ret
+}
+
+#[inline(always)]
+pub fn syscall4(nr: usize, a0: usize, a1: usize, a2: usize, a3: usize) -> usize {
+    let ret: usize;
+    unsafe {
+        core::arch::asm!(
+            "ecall",
+            in("a7") nr,
+            inlateout("a0") a0 => ret,
+            in("a1") a1,
+            in("a2") a2,
+            in("a3") a3,
+        );
+    }
+    ret
+}
+
 #[inline(always)]
 pub fn syscall5(nr: usize, a0: usize, a1: usize, a2: usize, a3: usize, a4: usize) -> usize {
     let ret: usize;

crates/userspace/src/syscall.rs

@@ -40,7 +40,7 @@ pub fn kill(process_cap: usize) -> usize {
 }
 
 pub fn delegate(slot: usize, to: usize, permissions: usize) -> usize {
-    arch::syscall2(SYS_DELEGATE, slot, to)
+    arch::syscall3(SYS_DELEGATE, slot, to, permissions)
 }
 
 pub fn revoke(slot: usize) -> usize {
@@ -59,3 +59,19 @@ pub fn send(endpoint: usize, w0: usize, w1: usize, w2: usize, w3: usize) -> usiz
 pub fn receive(endpoint: usize) -> (usize, usize, usize, usize) {
     arch::syscall_receive(SYS_RECEIVE, endpoint)
 }
+
+pub fn create_endpoint() -> usize {
+    arch::syscall0(SYS_CREATE_ENDPOINT)
+}
+
+pub fn debug_putchar(byte: u8) {
+    arch::syscall1(SYS_DEBUG_PUTCHAR, byte as usize);
+}
+
+pub fn map_page(process_cap: usize, src_va: usize, dst_va: usize, executable: bool) -> usize {
+    arch::syscall4(SYS_MAP_PAGE, process_cap, src_va, dst_va, executable as usize)
+}
+
+pub fn spawn_thread_in(process_cap: usize, entry: usize, stack: usize) -> usize {
+    arch::syscall3(SYS_SPAWN_THREAD_IN, process_cap, entry, stack)
+}