refactor: apply newtypes throughout userspace API and display types

Every syscall stub now uses proper types from types/ — CapSlot,
EntryPoint, StackPointer, VirtualAddress, PageCount, ProcessId,
PermissionSet, Ticks. The compiler prevents swapping entry/stack,
passing a ProcessId where a CapSlot is expected, or using an
address as a page count.

New display types in types/display.rs:
  - Color(u32) with rgb() constructor
  - ScreenCoord(u16) for x/y positions
  - Dimension(u16) for width/height

Updated throughout:
  - userspace/syscall.rs: all params typed, returns Option instead
    of sentinel usize::MAX
  - server-framework: endpoint param is CapSlot
  - port-framebuffer: trait uses Color, ScreenCoord, Dimension
  - hw-virtio: DmaAddrs uses PhysicalAddress/VirtualAddress,
    GPU commands use Dimension
  - All servers, drivers, bins, apps updated for new signatures
  - permission-manager: process field uses ProcessId
  - PermissionSet: added bits() accessor

89 tests pass, full QEMU boot verified.

crates/userspace/src/allocator/mod.rs

@@ -47,14 +47,18 @@ impl AllocatorInner {
             return ptr::null_mut();
         }
 
-        let page_addr = crate::syscall::request_pages(1);
-        if page_addr == usize::MAX {
-            return ptr::null_mut();
-        }
+        let count = match types::bounded::PageCount::new(1) {
+            Some(c) => c,
+            None => return ptr::null_mut(),
+        };
+        let va = match crate::syscall::request_pages(count) {
+            Some(va) => va,
+            None => return ptr::null_mut(),
+        };
 
-        self.pages[self.page_count] = page_addr;
+        self.pages[self.page_count] = va.raw();
         self.page_count += 1;
-        page_addr as *mut u8
+        va.raw() as *mut u8
     }
 
     fn alloc_from_free_list(&mut self, size: usize, align: usize) -> *mut u8 {

crates/userspace/src/syscall.rs

@@ -1,5 +1,10 @@
 use crate::arch;
 use types::syscall_abi::*;
+use types::address::{EntryPoint, StackPointer, VirtualAddress};
+use types::bounded::{CapSlot, PageCount};
+use types::id::ProcessId;
+use types::permission::PermissionSet;
+use types::time::Ticks;
 
 pub fn exit() -> ! {
     arch::syscall0(SYS_EXIT);
@@ -15,63 +20,66 @@ pub fn yield_now() {
     arch::syscall0(SYS_YIELD);
 }
 
-pub fn get_time() -> usize {
-    arch::syscall0(SYS_GET_TIME)
-}
-
-pub fn get_process_id() -> usize {
-    arch::syscall0(SYS_GET_PROCESS_ID)
-}
-
-pub fn spawn_thread(entry: usize, stack: usize) -> usize {
-    arch::syscall2(SYS_SPAWN_THREAD, entry, stack)
-}
-
-pub fn request_pages(count: usize) -> usize {
-    arch::syscall1(SYS_REQUEST_PAGES, count)
-}
-
-pub fn create_process(create_cap: usize) -> usize {
-    arch::syscall1(SYS_CREATE_PROCESS, create_cap)
-}
-
-pub fn kill(process_cap: usize) -> usize {
-    arch::syscall1(SYS_KILL, process_cap)
-}
-
-pub fn delegate(slot: usize, to: usize, permissions: usize) -> usize {
-    arch::syscall3(SYS_DELEGATE, slot, to, permissions)
-}
-
-pub fn revoke(slot: usize) -> usize {
-    arch::syscall1(SYS_REVOKE, slot)
-}
-
 pub fn halt() -> ! {
     arch::syscall0(SYS_HALT);
     loop {}
 }
 
-pub fn send(endpoint: usize, w0: usize, w1: usize, w2: usize, w3: usize) -> usize {
-    arch::syscall5(SYS_SEND, endpoint, w0, w1, w2, w3)
+pub fn get_time() -> Ticks {
+    Ticks::from_raw(arch::syscall0(SYS_GET_TIME) as u64)
 }
 
-pub fn receive(endpoint: usize) -> (usize, usize, usize, usize) {
-    arch::syscall_receive(SYS_RECEIVE, endpoint)
+pub fn get_process_id() -> ProcessId {
+    ProcessId::from_raw(arch::syscall0(SYS_GET_PROCESS_ID) as u16)
 }
 
-pub fn create_endpoint() -> usize {
-    arch::syscall0(SYS_CREATE_ENDPOINT)
+pub fn create_process(create_cap: CapSlot) -> Option<CapSlot> {
+    let r = arch::syscall1(SYS_CREATE_PROCESS, create_cap.value() as usize);
+    if r == usize::MAX { None } else { CapSlot::new(r as u8) }
+}
+
+pub fn create_endpoint() -> Option<CapSlot> {
+    let r = arch::syscall0(SYS_CREATE_ENDPOINT);
+    if r == usize::MAX { None } else { CapSlot::new(r as u8) }
+}
+
+pub fn spawn_thread(entry: EntryPoint, stack: StackPointer) -> usize {
+    arch::syscall2(SYS_SPAWN_THREAD, entry.raw(), stack.raw())
+}
+
+pub fn spawn_thread_in(process_cap: CapSlot, entry: EntryPoint, stack: StackPointer) -> usize {
+    arch::syscall3(SYS_SPAWN_THREAD_IN, process_cap.value() as usize, entry.raw(), stack.raw())
+}
+
+pub fn request_pages(count: PageCount) -> Option<VirtualAddress> {
+    let r = arch::syscall1(SYS_REQUEST_PAGES, count.value() as usize);
+    if r == usize::MAX { None } else { Some(VirtualAddress::from_raw(r)) }
+}
+
+pub fn map_page(process_cap: CapSlot, src_va: VirtualAddress, dst_va: VirtualAddress, executable: bool) -> bool {
+    arch::syscall4(SYS_MAP_PAGE, process_cap.value() as usize, src_va.raw(), dst_va.raw(), executable as usize) == 0
+}
+
+pub fn send(endpoint: CapSlot, w0: usize, w1: usize, w2: usize, w3: usize) -> usize {
+    arch::syscall5(SYS_SEND, endpoint.value() as usize, w0, w1, w2, w3)
+}
+
+pub fn receive(endpoint: CapSlot) -> (usize, usize, usize, usize) {
+    arch::syscall_receive(SYS_RECEIVE, endpoint.value() as usize)
+}
+
+pub fn delegate(slot: CapSlot, to: CapSlot, permissions: PermissionSet) -> bool {
+    arch::syscall3(SYS_DELEGATE, slot.value() as usize, to.value() as usize, permissions.bits() as usize) == 0
+}
+
+pub fn kill(process_cap: CapSlot) -> bool {
+    arch::syscall1(SYS_KILL, process_cap.value() as usize) == 0
+}
+
+pub fn revoke(slot: CapSlot) -> bool {
+    arch::syscall1(SYS_REVOKE, slot.value() as usize) == 0
 }
 
 pub fn debug_putchar(byte: u8) {
     arch::syscall1(SYS_DEBUG_PUTCHAR, byte as usize);
 }
-
-pub fn map_page(process_cap: usize, src_va: usize, dst_va: usize, executable: bool) -> usize {
-    arch::syscall4(SYS_MAP_PAGE, process_cap, src_va, dst_va, executable as usize)
-}
-
-pub fn spawn_thread_in(process_cap: usize, entry: usize, stack: usize) -> usize {
-    arch::syscall3(SYS_SPAWN_THREAD_IN, process_cap, entry, stack)
-}