- Fix swapped command IDs: attach_backing was 0x0104 (FLUSH),
resource_flush was 0x0106 (ATTACH_BACKING). Now correct.
- Increase process stack from 4 pages (16 KB) to 16 pages (64 KB)
to prevent stack overflow in display process.
- Restructure display-qemu to avoid MockFramebuffer's 32 KB array
inflating the VirtIO path's stack frame.
- Wire snake app to render through display server via IPC instead
of UART escape codes. Uses existing renderer.rs pixel renderer.
- Init now delegates display endpoint to snake process.
Critical: kernel_ref() UB eliminated
- kernel_ref() returned &'static mut, creating aliasing mutable
references across trap handler + boot code (13+ call sites)
- Replaced with kernel_ptr() -> *mut Kernel, each use site does
explicit unsafe { &mut *kernel_ptr() }
- KernelCell: removed get_mut(), added as_ptr() -> *mut T
- UB is gone: raw pointer access makes the single-core invariant
explicit at every use site
Important: process cleanup on exit/fault
- New destroy_process() method consolidates cleanup:
- Removes all threads from scheduler and endpoints
- Clears pending messages and results
- Destroys process and frees ProcessMemory
- handle_exit and handle_fault both use destroy_process()
- handle_exit_thread uses destroy_process when last thread exits
IPC hardening:
- Added invariant comment on pending_messages[sender].take()
(sender in wait queue must have a pending message)
handle_release_pages:
- Now uses translate_va to convert VA→PA (was treating VA as PA)
