refactor: unsafe only in adapter + libkos; forbid(unsafe_code) everywhere else; libkos Window (volatile, bounds-checked MMIO/DMA/shared mem), entry!, thread::spawn; MapRegion returns pages; kernel const-built (with_cores/install_platform); newtype addrs

crates/kernel/src/syscall/ipc/mod.rs

@@ -47,6 +47,14 @@ pub struct IpcState {
     pub(crate) bound: Option<NotificationId>,
 }
 
+impl IpcState {
+    pub const EMPTY: Self = Self {
+        outgoing: None,
+        reply_to: None,
+        bound: None,
+    };
+}
+
 impl<P: Platform> Kernel<P> {
     pub(crate) fn ipc(&self, tid: ThreadId) -> Option<&IpcState> {
         self.ipc.get(tid.raw() as usize)

crates/kernel/src/syscall/memory.rs

@@ -104,7 +104,7 @@ impl<P: Platform> Kernel<P> {
         slot: CapSlot,
         va: VirtualAddress,
         perms: PagePerms,
-    ) -> Result<(), KernelError> {
+    ) -> Result<PageCount, KernelError> {
         let cap = self.check_cap(pid, slot, Permission::Read)?;
         let needed = match perms {
             PagePerms::ReadOnly => Permission::Read,
@@ -118,7 +118,12 @@ impl<P: Platform> Kernel<P> {
             return Err(KernelError::WrongObject);
         };
         let via = self.cap_ref(pid, slot);
-        self.map_region_via(id, pid, va, perms, via)
+        self.map_region_via(id, pid, va, perms, via)?;
+        // How much was mapped, so the caller never reaches past it.
+        self.regions
+            .get(id)
+            .map(|r| r.pages())
+            .ok_or(KernelError::NoSuchObject)
     }
 
     /// Physical base of the region behind `slot` (needs Read); pool regions are contiguous.

crates/kernel/src/syscall/mod.rs

@@ -96,7 +96,7 @@ impl<P: Platform> Kernel<P> {
             }
             Syscall::MapRegion { region, va, perms } => complete(
                 self.map_region_cap(pid, region, va, perms)
-                    .map(|()| SyscallResult::Ok),
+                    .map(|pages| SyscallResult::Value(pages.value() as usize)),
             ),
             Syscall::RegionAddress { region } => complete(
                 self.region_address_cap(pid, region)