refactor: unsafe only in adapter + libkos; forbid(unsafe_code) everywhere else; libkos Window (volatile, bounds-checked MMIO/DMA/shared mem), entry!, thread::spawn; MapRegion returns pages; kernel const-built (with_cores/install_platform); newtype addrs

crates/servers/storage-server/src/lib.rs

@@ -1,4 +1,5 @@
 #![no_std]
+#![forbid(unsafe_code)]
 
 extern crate alloc;
 
@@ -18,11 +19,10 @@ use libkos::syscall;
 use types::address::VirtualAddress;
 use types::badge::Badge;
 use types::bounded::{CapSlot, PageCount};
-use types::mapping::PagePerms;
 use types::permission::{Permission, PermissionSet};
 
 /// Client buffers sit high in storage's window, clear of its heap.
-const BUFFERS_VA: usize = 0x0100_0000;
+const BUFFERS_VA: VirtualAddress = VirtualAddress::from_raw(0x0100_0000);
 
 const EP: CapSlot = CapSlot::const_new(0);
 
@@ -33,12 +33,10 @@ struct Kernel;
 
 impl server::Host for Kernel {
     fn create(&mut self, client: usize) -> Option<(&'static mut [u8], Option<CapSlot>)> {
-        let va = BUFFERS_VA + client * protocol::BUFFER_SIZE;
+        let va = VirtualAddress::from_raw(BUFFERS_VA.raw() + client * protocol::BUFFER_SIZE);
         let region = syscall::create_region(PageCount::new(protocol::BUFFER_PAGES as u16)?).ok()?;
-        syscall::map_region(region, VirtualAddress::from_raw(va), PagePerms::ReadWrite).ok()?;
-        // SAFETY: the region is mapped read-write at `va` for as long as
-        // the server holds `region`, which it never drops.
-        let buf = unsafe { core::slice::from_raw_parts_mut(va as *mut u8, protocol::BUFFER_SIZE) };
+        // Storage never drops `region`, so the buffer stays mapped.
+        let buf = libkos::window::map_buffer(region, va).ok()?;
         Some((buf, Some(region)))
     }