unsafe is a necessary escape hatch, but the temptation to use it to write C-style code is strong.
Out of curiosity, are you modeling this on an existing code base/architecture, or is this a new design?
As for unsafe, it would be possible to make much less of the kernel unsafe. The kernel allocation could be exposed in an interface like this:
struct Memory { address: usize }
impl Memory { fn new() -> Option<Memory>; fn realloc(&mut self, size: usize) -> Option<Memory>; fn size(&self) -> usize }
impl Drop for Memory { fn drop(&mut self) }
PIO could be wrapped up MUCH better:
PIO8, PIO16, and PIO32 could handle inb, inw, ind. A lot of my driver bugs have come from using the wrong size!
MMIO could be handled similarly.
The PCI driver could give drivers a limited set of PIO and MMIO structs to operate on