refactor: unsafe only in adapter + libkos; forbid(unsafe_code) everywhere else; libkos Window (volatile, bounds-checked MMIO/DMA/shared mem), entry!, thread::spawn; MapRegion returns pages; kernel const-built (with_cores/install_platform); newtype addrs

crates/adapter-riscv/src/boot/hardware.rs

@@ -1,5 +1,5 @@
 use crate::hw::uart::Uart;
-use crate::{KERNEL, board, mmu, platform, trap};
+use crate::{board, mmu, platform, trap};
 
 unsafe extern "C" {
     static _bss_start: u8;
@@ -56,17 +56,7 @@ pub fn init(uart: &Uart, boot_hart: usize) -> &'static mut mmu::PageTable {
     }
     let riscv_platform =
         platform::RiscVPlatform::new(kernel_pt as *const mmu::PageTable as usize, harts as u8);
-    // SAFETY: `init_in_place` writes every field of the kernel.
-    unsafe {
-        KERNEL.init_with(|slot| {
-            kernel::Kernel::init_in_place(
-                slot,
-                riscv_platform,
-                types::address::PhysicalAddress::from_raw(board::USER_POOL_BASE),
-                board::USER_POOL_PAGES,
-            )
-        });
-    }
+    crate::kern_mut().install_platform(riscv_platform);
 
     kernel_pt
 }

crates/adapter-riscv/src/kernel_cell.rs

@@ -11,22 +11,15 @@ pub struct KernelCell<T> {
 unsafe impl<T> Sync for KernelCell<T> {}
 
 impl<T> KernelCell<T> {
-    pub const fn uninit() -> Self {
+    /// Holds `value` from the start: built at compile time, so a large `T`
+    /// never lives on the stack.
+    pub const fn new(value: T) -> Self {
         Self {
-            initialized: AtomicBool::new(false),
-            inner: UnsafeCell::new(MaybeUninit::uninit()),
+            initialized: AtomicBool::new(true),
+            inner: UnsafeCell::new(MaybeUninit::new(value)),
         }
     }
 
-    /// Initializes in place, so a large `T` never lives on the stack.
-    ///
-    /// # Safety
-    /// `build` must fully initialize the `T` behind the pointer.
-    pub unsafe fn init_with(&self, build: impl FnOnce(*mut T)) {
-        build(unsafe { (*self.inner.get()).as_mut_ptr() });
-        self.initialized.store(true, Ordering::Release);
-    }
-
     /// Raw pointer to the kernel; callers must avoid aliasing `&mut`.
     pub fn as_ptr(&self) -> *mut T {
         debug_assert!(self.initialized.load(Ordering::Acquire));

crates/adapter-riscv/src/main.rs

@@ -15,7 +15,15 @@ mod trap;
 use hw::uart::Uart;
 use kernel_cell::KernelCell;
 
-static KERNEL: KernelCell<kernel::Kernel<platform::RiscVPlatform>> = KernelCell::uninit();
+/// Built at compile time; boot installs the real platform before anything
+/// runs.
+static KERNEL: KernelCell<kernel::Kernel<platform::RiscVPlatform>> =
+    KernelCell::new(kernel::Kernel::with_cores(
+        platform::RiscVPlatform::new(0, 1),
+        1,
+        types::address::PhysicalAddress::from_raw(board::USER_POOL_BASE),
+        board::USER_POOL_PAGES,
+    ));
 
 fn kern_mut() -> &'static mut kernel::Kernel<platform::RiscVPlatform> {
     // SAFETY: boot runs with the kernel lock held and before any other

crates/adapter-riscv/src/platform.rs

@@ -20,7 +20,7 @@ pub struct RiscVPlatform {
 }
 
 impl RiscVPlatform {
-    pub fn new(kernel_pt_addr: usize, num_cores: u8) -> Self {
+    pub const fn new(kernel_pt_addr: usize, num_cores: u8) -> Self {
         Self {
             num_cores,
             kernel_pt: kernel_pt_addr,