Split hart0_boot in half, so stacks can be switched in the middle.

1 files changed, 38 insertions, 6 deletions

diff --git a/crates/kernel/src/lib.rs b/crates/kernel/src/lib.rs
index 6e09d2b..c0da3bf 100644
--- a/crates/kernel/src/lib.rs
+++ b/crates/kernel/src/lib.rs
@@ -15,18 +15,26 @@ mod panic;
 pub mod arch;
 pub mod logger;
 
-/// The entrypoint to the kernel. This should be executed by hart0 alone. It performs some early
-/// boot tasks, then wakes up any other harts.
+/// The first stage of booting the kernel. This should be executed by hart0 alone. It runs with
+/// paging disabled, and:
+///
+/// - sets up a physical memory allocator
+/// - sets up paging
+/// - allocates some global structures in the higher half of memory:
+///   - a logger's buffer
+///   - a stack for this kernel thread
+///   - the DeviceTree in tree form
+///
+/// It returns the top address of the stack for this kernel thread.
 ///
 /// # Safety
 ///
 /// - The `device_tree` pointer must be a valid pointer into physical memory. See
 ///   `device_tree::FlattenedDeviceTree::from_ptr` for the precise requirements.
-/// - This must be called in supervisor mode with paging and traps disabled, but with all traps
-///   delegated to supervisor mode.
-/// - Any other harts must not be running concurrently with us. TODO: Define their state.
+/// - This must be called in supervisor mode with paging disabled.
+/// - Any other harts must not be running concurrently with us.
 #[no_mangle]
-pub unsafe extern "C" fn hart0_boot(device_tree: *const u8) -> ! {
+pub unsafe extern "C" fn hart0_early_boot(device_tree: *const u8) -> ! {
     // Set up the logger.
     logger::init();
 
@@ -79,6 +87,25 @@ pub unsafe extern "C" fn hart0_boot(device_tree: *const u8) -> ! {
             .expect("failed to configure the buddy allocator");
     dbg!(alloc_buddy.debug_free_lists());
 
+    todo!()
+}
+
+/// The entrypoint to the kernel, to be run after paging is set up. This should be executed by
+/// hart0 alone. It performs some early boot tasks, then wakes up any other harts.
+///
+/// It receives the stack canary from the initial stack, and validates it.
+///
+/// # Safety
+///
+/// - `hart0_early_boot` must have been called.
+/// - This must be called in supervisor mode with traps disabled, but with all traps delegated to
+///   supervisor mode.
+/// - Any other harts must not be running concurrently with us. TODO: Define their state.
+#[no_mangle]
+pub unsafe extern "C" fn hart0_boot(stack_canary: u64) -> ! {
+    assert_eq!(stack_canary, 0xdead0bad0defaced);
+
+    /*
     // After this point, everything else is for debugging.
     #[cfg(target_arch = "riscv64")]
     {
@@ -98,6 +125,11 @@ pub unsafe extern "C" fn hart0_boot(device_tree: *const u8) -> ! {
             .unwrap_or_else(|err| void::unreachable(err));
         arch::interrupts::example_timer();
     }
+    */
+
+    if true {
+        todo!();
+    }
     info!("sleeping forever...");
     sleep_forever();
 }