M2 step 3: route every physical dereference through the physmap

paging.init now builds the physmap (physToVirt(phys)) alongside the low
identity map, so both addressing modes resolve during the transition.
tableAt (the page-table walk hinge), the pmm bitmap, the framebuffer,
LAPIC/IOAPIC/HPET/PM-timer/SPCR MMIO, the ACPI table walk, AML
OperationRegions, the ACPI power registers, the user-ELF frame fills,
and the AP trampoline arm/disarm all reach physical memory through the
physmap. Hal.mapMmio now maps into the physmap and returns the virtual
address, so the device layer never learns the layout. boot_info and its
pointees are converted at kmain entry. The kernel still links and runs
low; identity is the safety net until it's removed. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/kernel/arch/x86_64/apic.zig

@@ -9,6 +9,7 @@
 //! map). Every interrupt must be acknowledged with an end-of-interrupt write, or
 //! the LAPIC won't deliver the next one.
 
+const danos = @import("danos");
 const io = @import("io.zig");
 const paging = @import("paging.zig");
 
@@ -118,7 +119,8 @@ pub fn init() void {
     if (cfg_pic_present) remapAndMaskPic();
 
     const msr = io.rdmsr(ia32_apic_base_msr);
-    base = @intCast(msr & 0xFFFFF000); // physical base is bits 12+
+    // Reach the LAPIC through the physmap (paging.init maps its page there).
+    base = @intCast(danos.physToVirt(msr & 0xFFFFF000)); // physical base is bits 12+
     io.wrmsr(ia32_apic_base_msr, msr | (1 << 11)); // global enable
 
     write(reg_spurious, 0x100 | spurious_vector); // bit 8 = software enable
@@ -299,8 +301,10 @@ fn hpetWrite64(off: usize, value: u64) void {
 }
 
 /// Map + enable the HPET and return its tick frequency, or null if unusable.
+/// Maps the HPET into the physmap and switches cfg_hpet_base to that virtual
+/// address, so the register accessors reach it without the identity map.
 fn hpetHz() ?u64 {
-    paging.map(cfg_hpet_base & ~@as(u64, 0xFFF), cfg_hpet_base & ~@as(u64, 0xFFF), true);
+    cfg_hpet_base = paging.mapMmio(cfg_hpet_base, 0x400, true);
     const caps = hpetRead64(0x00);
     const period_fs = caps >> 32; // femtoseconds per tick
     if (period_fs == 0) return null;
@@ -319,7 +323,9 @@ fn readHpet() u64 {
 
 fn readPmTimer() u64 {
     const pt = cfg_pm_timer.?;
-    if (pt.mmio) return @as(*volatile u32, @ptrFromInt(pt.address)).*;
+    // MMIO PM timer via the physmap (mapMmio is idempotent); the common case is
+    // a legacy I/O port.
+    if (pt.mmio) return @as(*volatile u32, @ptrFromInt(paging.mapMmio(pt.address, 4, false))).*;
     return io.inl(@intCast(pt.address));
 }