refactor: unsafe only in adapter + libkos; forbid(unsafe_code) everywhere else; libkos Window (volatile, bounds-checked MMIO/DMA/shared mem), entry!, thread::spawn; MapRegion returns pages; kernel const-built (with_cores/install_platform); newtype addrs

crates/libkos/src/fs.rs

@@ -5,7 +5,6 @@
 use crate::syscall;
 use types::address::VirtualAddress;
 use types::bounded::CapSlot;
-use types::mapping::PagePerms;
 use types::storage::{DIR_ENTRY_SIZE, DIR_FLAG_DIRECTORY, DIR_NAME_SIZE, MAX_PATH, op, reply};
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -55,7 +54,7 @@ pub struct Storage {
 impl Storage {
     /// Attaches to the server behind `ep`, mapping the buffer it shares
     /// at `va` (which must be free for `BUFFER_SIZE` bytes).
-    pub fn attach(ep: CapSlot, va: usize) -> Result<Self> {
+    pub fn attach(ep: CapSlot, va: VirtualAddress) -> Result<Self> {
         let reply = syscall::call(ep, [op::ATTACH, 0, 0, 0], None).map_err(|_| FsError::Failed)?;
         let [tag, size, _, _] = reply.words();
         let cap = match reply {
@@ -65,11 +64,8 @@ impl Storage {
         let (true, Some(region)) = (tag == reply::ATTACHED, cap) else {
             return Err(FsError::Failed);
         };
-        syscall::map_region(region, VirtualAddress::from_raw(va), PagePerms::ReadWrite)
-            .map_err(|_| FsError::Failed)?;
-        // SAFETY: the region the server made, `size` bytes, is now mapped
-        // read-write at `va` and stays so while this process holds it.
-        let buf = unsafe { core::slice::from_raw_parts_mut(va as *mut u8, size) };
+        let mapped = crate::window::map_buffer(region, va).map_err(|_| FsError::Failed)?;
+        let buf = mapped.get_mut(..size).ok_or(FsError::Failed)?;
         Ok(Self { ep, buf })
     }