feat: bring back multicore support (#252)

* feat(loader): make multicore ready

* fix(loader): don't zero out BSS from secondary harts

* feat(loader): start secondary harts

* feat(loader): map kernel stacks & TLS regions

* fix(sync): don't deadlock in `Once::poll`

* fix(kernel): use global shared logger for prettier printing

* feat(kernel): make initialization multicore ready

* clippy

* docs

Cargo.lock

···
  "rand 0.8.5",
  "rand_chacha 0.3.1",
  "riscv",
+ "sync",
  "xmas-elf",
 ]
 

kernel/src/arch/riscv64/mod.rs

···
 // copied, modified, or distributed except according to those terms.
 
 mod setjmp_longjmp;
-mod start;
 mod trap_handler;
 mod utils;
 mod vm;
···
     KERNEL_ASPACE_BASE, PAGE_SHIFT, PAGE_SIZE, USER_ASPACE_BASE,
 };
 
+/// Global RISC-V specific initialization.
 #[cold]
 pub fn init() {
     let supported = riscv::sbi::supported_extensions().unwrap();
     log::trace!("Supported SBI extensions: {supported:?}");
 
-    log::trace!("BOOT STACK {:?}", start::BOOT_STACK.0.as_ptr_range());
-
     vm::init();
+}
 
-    // TODO riscv64_mmu_early_init_percpu
+/// Early per-hart and RISC-V specific initialization.
+///
+/// This function will be called before global initialization is done, notably this function
+/// cannot call logging functions, cannot allocate memory, cannot access hart-local state and should
+/// not panic as the panic handler is not initialized yet.
+#[cold]
+pub fn per_hart_init_early() {
+    // Safety: register access
+    unsafe {
+        // enable counters
+        scounteren::set_cy();
+        scounteren::set_tm();
+        scounteren::set_ir();
+
+        // Set the FPU state to initial
+        sstatus::set_fs(FS::Initial);
+    }
 }
 
+/// Late per-hart and RISC-V specific initialization.
+///
+/// This function will be called after all global initialization is done.
 #[cold]
-pub fn per_hart_init() {
+pub fn per_hart_init_late() {
     // Safety: register access
     unsafe {
         // Initialize the trap handler
···
         // Enable supervisor timer and external interrupts
         sie::set_stie();
         sie::set_seie();
-
-        // enable counters
-        scounteren::set_cy();
-        scounteren::set_tm();
-        scounteren::set_ir();
-
-        // Set the FPU state to initial
-        sstatus::set_fs(FS::Initial);
     }
 }
 

kernel/src/arch/riscv64/start.rs

···
-// Copyright 2025 Jonas Kruckenberg
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-use crate::arch::PAGE_SIZE;
-use crate::STACK_SIZE_PAGES;
-use core::arch::naked_asm;
-use loader_api::LoaderConfig;
-
-#[unsafe(link_section = ".bss.uninit")]
-pub static BOOT_STACK: Stack = Stack([0; STACK_SIZE_PAGES * PAGE_SIZE]);
-
-#[repr(C, align(128))]
-pub struct Stack(pub [u8; STACK_SIZE_PAGES * PAGE_SIZE]);
-
-#[used(linker)]
-#[unsafe(link_section = ".loader_config")]
-static LOADER_CONFIG: LoaderConfig = LoaderConfig::new_default();
-
-#[unsafe(no_mangle)]
-#[naked]
-unsafe extern "C" fn _start(hartid: usize, boot_info: &'static loader_api::BootInfo) -> ! {
-    // Safety: inline assembly
-    unsafe {
-        naked_asm! {
-            // Setup the stack pointer
-            "la   t0, {boot_stack_start}",  // set the stack pointer to the bottom of the stack
-            "li   t1, {boot_stack_size}",   // load the stack size
-            "add  sp, t0, t1",              // add both to get the top of the stack
-
-            // Fill the stack with a canary pattern (0xACE0BACE) so that we can identify unused stack memory
-            // in dumps & calculate stack usage. This is also really great (don't ask my why I know this) to identify
-            // when we tried executing stack memory.
-            "li          t1, 0xACE0BACE",
-            "1:",
-            "   sw          t1, 0(t0)",     // write the canary as u64
-            "   addi        t0, t0, 8",     // move to the next u64
-            "   bltu        t0, sp, 1b",    // loop until we reach the top of the stack
-
-            // Call the rust entry point
-            "call {start_rust}",
-
-            // Loop forever.
-            // `start_rust` should never return, but in case it does prevent the hart from executing
-            // random code
-            "2:",
-            "   wfi",
-            "   j 2b",
-
-            boot_stack_start = sym BOOT_STACK,
-            boot_stack_size = const STACK_SIZE_PAGES * PAGE_SIZE,
-            start_rust = sym crate::main,
-        }
-    }
-}

kernel/src/arch/riscv64/trap_handler.rs

···
             .byte_add(TRAP_STACK_SIZE_PAGES * PAGE_SIZE) as *mut u8
     };
 
-    log::debug!("setting sscratch to {:p}", trap_stack_top);
+    log::trace!("setting sscratch to {:p}", trap_stack_top);
     // Safety: inline assembly
     unsafe {
         asm!(
···
         );
     }
 
-    log::debug!("setting trap vec to {:#x}", trap_vec as usize);
+    log::trace!("setting trap vec to {:#x}", trap_vec as usize);
     // Safety: register access
     unsafe { stvec::write(trap_vec as usize, stvec::Mode::Vectored) };
 }

kernel/src/logger.rs

···
 // http://opensource.org/licenses/MIT>, at your option. This file may not be
 // copied, modified, or distributed except according to those terms.
 
-use core::cell::RefCell;
-use core::fmt::Write;
+use core::cell::Cell;
 use log::{LevelFilter, Metadata, Record};
 use thread_local::thread_local;
 
-/// Initializes the global logger with the semihosting logger.
-///
-/// # Panics
-///
-/// This function will panic if it is called more than once, or if another library has already initialized a global logger.
+thread_local!(
+    static HARTID: Cell<usize> = Cell::new(usize::MAX);
+);
+
 pub fn init(lvl: LevelFilter) {
     static LOGGER: Logger = Logger;
 
···
     log::set_max_level(lvl);
 }
 
-pub fn init_hart(hartid: usize) {
-    STATE.with_borrow_mut(|state| state.1 = hartid);
+pub fn per_hart_init(hartid: usize) {
+    HARTID.set(hartid);
 }
-
-thread_local!(
-    static STATE: RefCell<(riscv::hio::HostStream, usize)> =
-        RefCell::new((riscv::hio::HostStream::new_stdout(), 0));
-);
 
 struct Logger;
 
···
 
     fn log(&self, record: &Record) {
         if self.enabled(record.metadata()) {
-            let _ = STATE.try_with(|state| {
-                // Safety: state is always initialized
-                let (stdout, hartid) = unsafe { &mut *state.as_ptr() };
-                let _ = stdout.write_fmt(format_args!(
-                    "[{:<5} HART {} {}] {}\n",
-                    record.level(),
-                    *hartid,
-                    record.module_path_static().unwrap_or_default(),
-                    record.args()
-                ));
-            });
+            print(format_args!(
+                "[{:<5} HART {} {}] {}\n",
+                record.level(),
+                HARTID.get(),
+                record.module_path_static().unwrap_or_default(),
+                record.args()
+            ));
         }
     }
 
     fn flush(&self) {}
 }
+
+fn print(args: core::fmt::Arguments) {
+    cfg_if::cfg_if! {
+        if #[cfg(any(target_arch = "riscv64", target_arch = "riscv32"))] {
+            riscv::hio::_print(args);
+        } else {
+            compile_error!("unsupported target architecture");
+        }
+    }
+}

kernel/src/main.rs

···
 use crate::time::Instant;
 use crate::vm::bootstrap_alloc::BootstrapAllocator;
 use arrayvec::ArrayVec;
-use core::alloc::Layout;
 use core::cell::RefCell;
 use core::range::Range;
-use core::{cmp, slice};
-use loader_api::{BootInfo, MemoryRegionKind, TlsTemplate};
-use sync::OnceLock;
+use loader_api::{BootInfo, LoaderConfig, MemoryRegionKind};
+use sync::{Once, OnceLock};
 use thread_local::thread_local;
 use vm::frame_alloc;
-use vm::{PhysicalAddress, VirtualAddress};
+use vm::PhysicalAddress;
 
 /// The log level for the kernel
 pub const LOG_LEVEL: log::Level = log::Level::Trace;
 /// The size of the stack in pages
-pub const STACK_SIZE_PAGES: usize = 128; // TODO find a lower more appropriate value
+pub const STACK_SIZE_PAGES: u32 = 128; // TODO find a lower more appropriate value
 /// The size of the trap handler stack in pages
 pub const TRAP_STACK_SIZE_PAGES: usize = 64; // TODO find a lower more appropriate value
 /// The initial size of the kernel heap in pages.
···
         RefCell::new(HartLocalMachineInfo::default());
 );
 
-fn main(hartid: usize, boot_info: &'static BootInfo) -> ! {
-    // initialize a simple bump allocator for allocating memory before our virtual memory subsystem
-    // is available
-    let allocatable_memories = allocatable_memory_regions(boot_info);
-    let mut boot_alloc = BootstrapAllocator::new(&allocatable_memories);
+#[used(linker)]
+#[unsafe(link_section = ".loader_config")]
+static LOADER_CONFIG: LoaderConfig = {
+    let mut cfg = LoaderConfig::new_default();
+    cfg.kernel_stack_size_pages = STACK_SIZE_PAGES;
+    cfg
+};
 
-    // initializing the global allocator
-    allocator::init(&mut boot_alloc, boot_info);
+// | hart | stack                                  | tls                                    |
+// |------|----------------------------------------|----------------------------------------|
+// | 0    | 0xffffffc0c008c000..0xffffffc0c00a0000 | 0xffffffc040000000..0xffffffc0400400c2 |
+// | 1    | 0xffffffc0c0078000..0xffffffc0c008c000 | 0xffffffc0400400c2..0xffffffc040080184 |
+// | 2    | 0xffffffc0c0064000..0xffffffc0c0078000 | 0xffffffc040080184..0xffffffc0400c0246 |
+// | 3    | 0xffffffc0c0050000..0xffffffc0c0064000 | 0xffffffc0400c0246..0xffffffc040100308 |
+// | 4    | 0xffffffc0c003c000..0xffffffc0c0050000 | 0xffffffc040100308..0xffffffc0401403ca |
+// | 5    | 0xffffffc0c0028000..0xffffffc0c003c000 | 0xffffffc0401403ca..0xffffffc04018048c |
+// | 6    | 0xffffffc0c0014000..0xffffffc0c0028000 | 0xffffffc04018048c..0xffffffc0401c054e |
+// | 7    | 0xffffffc0c0000000..0xffffffc0c0014000 | 0xffffffc0401c054e..0xffffffc040200610 |
 
-    // initialize the panic backtracing subsystem after the allocator has been set up
-    // since setting up the symbolization context requires allocation
-    panic::init(boot_info);
+#[unsafe(no_mangle)]
+fn _start(hartid: usize, boot_info: &'static BootInfo, boot_ticks: u64) -> ! {
+    // initialize the hart local state of the logger before enabling it, so it is ready as soon as
+    // logging is turned on
+    logger::per_hart_init(hartid);
 
-    // initialize thread-local storage
-    // done after global allocator initialization since TLS destructors are registered in a heap
-    // allocated Vec
-    let tls = init_tls(&mut boot_alloc, &boot_info.tls_template);
+    // perform EARLY per-hart, architecture-specific initialization
+    // (e.g. resetting the FPU)
+    arch::per_hart_init_early();
 
-    // initialize the logger
-    // done after TLS initialization since we maintain per-hart host stdio channels
-    logger::init_hart(hartid);
-    logger::init(LOG_LEVEL.to_level_filter());
+    let fdt = locate_device_tree(boot_info);
 
-    log::debug!("\n{boot_info}");
-    log::trace!("Allocatable memory regions: {allocatable_memories:?}");
-    log::trace!("Thread pointer: {tls:?}");
+    static SYNC: Once = Once::new();
+    SYNC.call_once(|| {
+        // initialize the global logger as early as possible
+        logger::init(LOG_LEVEL.to_level_filter());
 
-    // perform per-hart, architecture-specific initialization
-    // (e.g. setting the trap vector and resetting the FPU)
-    arch::per_hart_init();
+        // initialize a simple bump allocator for allocating memory before our virtual memory subsystem
+        // is available
+        let allocatable_memories = allocatable_memory_regions(boot_info);
+        let mut boot_alloc = BootstrapAllocator::new(&allocatable_memories);
+
+        // initializing the global allocator
+        allocator::init(&mut boot_alloc, boot_info);
+
+        // initialize the panic backtracing subsystem after the allocator has been set up
+        // since setting up the symbolization context requires allocation
+        panic::init(boot_info);
+
+        // perform global, architecture-specific initialization
+        arch::init();
 
-    // perform global, architecture-specific initialization
-    arch::init();
+        // // TODO move this into a init function
+        let minfo = MACHINE_INFO
+            .get_or_try_init(|| {
+                // Safety: we have to trust the loader mapped the fdt correctly
+                unsafe { MachineInfo::from_dtb(fdt) }
+            })
+            .unwrap();
+        log::debug!("\n{minfo}");
 
-    let fdt = locate_device_tree(boot_info);
+        // initialize the global frame allocator
+        frame_alloc::init(boot_alloc);
 
-    // TODO move this into a init function
-    let minfo = MACHINE_INFO
-        .get_or_try_init(|| {
-            // Safety: we have to trust the loader mapped the fdt correctly
-            unsafe { MachineInfo::from_dtb(fdt) }
-        })
-        .unwrap();
-    log::debug!("\n{minfo}");
+        // initialize the virtual memory subsystem
+        vm::init(boot_info, minfo).unwrap();
+    });
 
-    // Safety: we have to trust the loader mapped the fdt correctly
+    // // Safety: we have to trust the loader mapped the fdt correctly
     let hart_local_minfo = unsafe { HartLocalMachineInfo::from_dtb(hartid, fdt).unwrap() };
     log::debug!("\n{hart_local_minfo}");
     HART_LOCAL_MACHINE_INFO.set(hart_local_minfo);
 
-    frame_alloc::init(boot_alloc);
-
-    // TODO init kernel address space (requires global allocator)
-
-    vm::init(boot_info, minfo).unwrap();
+    // perform EARLY per-hart, architecture-specific initialization
+    // (e.g. setting the trap vector and enabling interrupts)
+    arch::per_hart_init_late();
 
     log::info!(
         "Booted in ~{:?} ({:?} in k23)",
         Instant::now().duration_since(Instant::ZERO),
-        Instant::from_ticks(boot_info.boot_ticks).elapsed()
+        Instant::from_ticks(boot_ticks).elapsed()
     );
+
     // wasm::test();
 
     // - [all][global] parse cmdline
···
     }
 
     arch::exit(0);
-}
-
-fn init_tls(
-    boot_alloc: &mut BootstrapAllocator,
-    maybe_tls_template: &Option<TlsTemplate>,
-) -> Option<VirtualAddress> {
-    if let Some(template) = &maybe_tls_template {
-        let layout =
-            Layout::from_size_align(template.mem_size, cmp::max(template.align, arch::PAGE_SIZE))
-                .unwrap();
-        let phys = boot_alloc.allocate_contiguous_zeroed(layout).unwrap();
-
-        // Use the phys_map to access the newly allocated TLS region
-        let virt = VirtualAddress::from_phys(phys).unwrap();
-
-        if template.file_size != 0 {
-            // Safety: We have to trust the loaders BootInfo here
-            unsafe {
-                let src: &[u8] =
-                    slice::from_raw_parts(template.start_addr as *const u8, template.file_size);
-                let dst: &mut [u8] =
-                    slice::from_raw_parts_mut(virt.as_mut_ptr(), template.file_size);
-
-                // sanity check to ensure our destination allocated memory is actually zeroed.
-                // if it's not, that likely means we're about to override something important
-                debug_assert!(dst.iter().all(|&x| x == 0));
-
-                dst.copy_from_slice(src);
-            }
-        }
-
-        arch::set_thread_ptr(virt);
-        Some(virt)
-    } else {
-        None
-    }
 }
 
 /// Builds a list of memory regions from the boot info that are usable for allocation.

libs/sync/src/barrier.rs

···
+// Copyright 2025 Jonas Kruckenberg
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+use crate::Mutex;
+use core::hint;
+
+pub struct Barrier {
+    lock: Mutex<BarrierState>,
+    num_threads: usize,
+}
+
+// The inner state of a double barrier
+struct BarrierState {
+    count: usize,
+    generation_id: usize,
+}
+
+pub struct BarrierWaitResult(bool);
+
+impl Barrier {
+    pub const fn new(n: usize) -> Self {
+        Self {
+            lock: Mutex::new(BarrierState {
+                count: 0,
+                generation_id: 0,
+            }),
+            num_threads: n,
+        }
+    }
+
+    pub fn wait(&self) -> BarrierWaitResult {
+        let mut lock = self.lock.lock();
+        lock.count += 1;
+
+        if lock.count < self.num_threads {
+            // not the leader
+            let local_gen = lock.generation_id;
+
+            while local_gen == lock.generation_id && lock.count < self.num_threads {
+                drop(lock);
+                hint::spin_loop();
+                lock = self.lock.lock();
+            }
+            BarrierWaitResult(false)
+        } else {
+            // this thread is the leader,
+            //   and is responsible for incrementing the generation
+            lock.count = 0;
+            lock.generation_id = lock.generation_id.wrapping_add(1);
+            BarrierWaitResult(true)
+        }
+    }
+}
+
+impl BarrierWaitResult {
+    pub fn is_leader(&self) -> bool {
+        self.0
+    }
+}

libs/sync/src/lib.rs

···
 #![no_std]
 #![cfg_attr(feature = "thread-local", feature(thread_local))]
 
+mod barrier;
 mod lazy_lock;
 mod once;
 mod once_lock;
···
 pub use raw_mutex::RawMutex;
 pub use raw_rwlock::RawRwLock;
 
+pub use barrier::{Barrier, BarrierWaitResult};
 pub use lazy_lock::LazyLock;
 pub use once::Once;
 pub use once_lock::OnceLock;

libs/sync/src/once.rs

···
         }
     }
 
-    fn wait(&self) {
-        loop {
-            if !self.poll() {
-                core::hint::spin_loop();
-            }
+    pub fn wait(&self) {
+        while !self.poll() {
+            core::hint::spin_loop();
         }
     }
 }

loader/Cargo.toml

···
 [dependencies]
 dtb-parser.workspace = true
 loader-api.workspace = true
+sync.workspace = true
 
 log.workspace = true
 cfg-if.workspace = true

loader/api/src/config.rs

···
 #[repr(C)]
 pub struct LoaderConfig {
     magic: u32,
+    /// The size of the stack that the loader should allocate for the kernel (in pages).
+    ///
+    /// The loader starts the kernel with a valid stack pointer. This setting defines
+    /// the stack size that the loader should allocate and map.
+    ///
+    /// The stack is created with an additional guard page, so a stack overflow will lead to
+    /// a page fault.
+    pub kernel_stack_size_pages: u32,
 }
 
 impl LoaderConfig {
     /// Creates a new default configuration with the following values:
     ///
     /// - `kernel_stack_size_pages`: 20
-    /// - `kernel_heap_size_pages`: None
-    /// - `memory_mode`: The default memory mode for the target architecture (Sv39 for Risc-V).
     #[must_use]
     pub const fn new_default() -> Self {
-        Self { magic: CFG_MAGIC }
+        Self {
+            magic: CFG_MAGIC,
+            kernel_stack_size_pages: 20,
+        }
     }
 
     /// Asserts that the configuration is valid.

loader/api/src/info.rs

···
 #[derive(Debug)]
 #[non_exhaustive]
 pub struct BootInfo {
+    pub hart_mask: usize,
     /// A map of the physical memory regions of the underlying machine.
     ///
     /// The loader parses this information from the firmware and also reports regions used
···
     ///
     /// This field can be used by the kernel to perform introspection of its own ELF file.
     pub kernel_phys: Range<usize>, // PhysicalAddress
-    pub boot_ticks: u64,
 }
 
 impl BootInfo {
···
     pub fn new(memory_regions: MemoryRegions) -> Self {
         Self {
             memory_regions,
+            hart_mask: 0,
             physical_address_offset: Default::default(),
             physical_memory_map: Default::default(),
             tls_template: None,
             kernel_virt: Default::default(),
             kernel_phys: Default::default(),
-            boot_ticks: 0,
         }
     }
 }

loader/riscv64-qemu.ld

···
         __data_end = .;
     }
 
+    __stack_start = .;
+
     /DISCARD/ : {
         *(.comment*)
         *(.gcc_except_table*)

loader/src/arch/riscv64.rs

···
 
 use crate::error::Error;
 use crate::frame_alloc::FrameAllocator;
+use crate::machine_info::MachineInfo;
 use crate::mapping::Flags;
+use crate::GlobalInitResult;
 use bitflags::bitflags;
 use core::arch::{asm, naked_asm};
 use core::fmt;
 use core::num::NonZero;
 use core::ptr::NonNull;
-use loader_api::BootInfo;
 use riscv::satp;
 
 pub const DEFAULT_ASID: u16 = 0;
···
 /// On `RiscV` targets the page table entry's physical address bits are shifted 2 bits to the right.
 const PTE_PPN_SHIFT: usize = 2;
 
-const BOOT_STACK_SIZE: usize = 32 * PAGE_SIZE;
-
-#[unsafe(link_section = ".bss.uninit")]
-static BOOT_STACK: Stack = Stack([0; BOOT_STACK_SIZE]);
-
-#[repr(C, align(128))]
-struct Stack([u8; BOOT_STACK_SIZE]);
-
+/// Entry point for the initializing hart, this will set up the CPU environment for Rust and then
+/// transfer control to [`crate::main`].
+///
+/// For the entry point of all secondary harts see [`_start_secondary`].
 #[unsafe(link_section = ".text.start")]
 #[unsafe(no_mangle)]
 #[naked]
···
             "rdtime a2",
 
             // Clear return address and frame pointer
-            "mv ra, zero",
-            "mv s0, zero",
+            "mv     ra, zero",
+            "mv     s0, zero",
 
             // Clear the gp register in case anything tries to use it.
-            "mv gp, zero",
+            "mv     gp, zero",
 
             // Mask all interrupts in case the previous stage left them on.
-            "csrc sstatus, 1 << 1",
-            "csrw sie, zero",
+            "csrc   sstatus, 1 << 1",
+            "csrw   sie, zero",
 
             // Reset the trap vector in case the previous stage left one installed.
-            "csrw stvec, zero",
+            "csrw   stvec, zero",
 
             // Disable the MMU in case it was left on.
-            "csrw satp, zero",
+            "csrw   satp, zero",
 
             // Setup the stack pointer
-            "la   t0, {boot_stack_start}",  // set the stack pointer to the bottom of the stack
-            "li   t1, {boot_stack_size}",   // load the stack size
-            "add  sp, t0, t1",              // add both to get the top of the stack
+            "la     t0, __stack_start", // set the stack pointer to the bottom of the stack
+            "li     t1, {stack_size}",  // load the stack size
+            "mul    sp, a0, t1",        // multiply the stack size by the hart id to get the relative stack bottom offset
+            "add    t0, t0, sp",        // add the relative stack bottom offset to the absolute stack region offset to get
+                                        // the absolute stack bottom
+            "add    sp, t0, t1",        // add one stack size again to get to the top of the stack. This is our final stack pointer.
+
+            // fill stack with canary pattern
+            // $sp is set to stack top above, $t0 as well
+            "call   {fill_stack}",
+
+            // Clear .bss.  The linker script ensures these are aligned to 16 bytes.
+            "lla    a3, __bss_zero_start",
+            "lla    a4, __bss_end",
+            "0:",
+            "   sd      zero, (a3)",
+            "   sd      zero, 8(a3)",
+            "   add     a3, a3, 16",
+            "   blt     a3, a4, 0b",
+
+            // Call the rust entry point
+            "call {start_rust}",
+
+            // Loop forever.
+            // `start_rust` should never return, but in case it does prevent the hart from executing
+            // random code
+            "2:",
+            "   wfi",
+            "   j 2b",
+
+            stack_size = const crate::STACK_SIZE,
+            start_rust = sym crate::main,
+            fill_stack = sym fill_stack
+        }
+    }
+}
+
+/// Entry point for all secondary harts, this is essentially the same as [`_start`] but it doesn't
+/// attempt to zero out the BSS.
+///
+/// It will however transfer control to the common [`crate::main`] routine.
+#[naked]
+unsafe extern "C" fn _start_secondary() -> ! {
+    // Safety: inline assembly
+    unsafe {
+        naked_asm! {
+            // read boot time stamp as early as possible
+            "rdtime a2",
+
+            // Clear return address and frame pointer
+            "mv     ra, zero",
+            "mv     s0, zero",
+
+            // Clear the gp register in case anything tries to use it.
+            "mv     gp, zero",
+
+            // Mask all interrupts in case the previous stage left them on.
+            "csrc   sstatus, 1 << 1",
+            "csrw   sie, zero",
+
+            // Reset the trap vector in case the previous stage left one installed.
+            "csrw   stvec, zero",
+
+            // Disable the MMU in case it was left on.
+            "csrw   satp, zero",
+
+            // Setup the stack pointer
+            "la     t0, __stack_start", // set the stack pointer to the bottom of the stack
+            "li     t1, {stack_size}",  // load the stack size
+            "mul    sp, a0, t1",        // multiply the stack size by the hart id to get the relative stack bottom offset
+            "add    t0, t0, sp",        // add the relative stack bottom offset to the absolute stack region offset to get
+                                        // the absolute stack bottom
+            "add    sp, t0, t1",        // add one stack size again to get to the top of the stack. This is our final stack pointer.
 
-            // Fill the stack with a canary pattern (0xACE0BACE) so that we can identify unused stack memory
-            // in dumps & calculate stack usage. This is also really great (don't ask my why I know this) to identify
-            // when we tried executing stack memory.
-            "li          t1, 0xACE0BACE",
-            "1:",
-            "   sw          t1, 0(t0)",     // write the canary as u64
-            "   addi        t0, t0, 8",     // move to the next u64
-            "   bltu        t0, sp, 1b",    // loop until we reach the top of the stack
+            // fill stack with canary pattern
+            // $sp is set to stack top above, $t0 as well
+            "call   {fill_stack}",
 
             // Call the rust entry point
             "call {start_rust}",
···
             "   wfi",
             "   j 2b",
 
-            boot_stack_start = sym BOOT_STACK,
-            boot_stack_size = const BOOT_STACK_SIZE,
+            stack_size = const crate::STACK_SIZE,
             start_rust = sym crate::main,
+            fill_stack = sym fill_stack
         }
     }
 }
 
-pub unsafe fn handoff_to_kernel(hartid: usize, boot_info: *mut BootInfo, entry: usize) -> ! {
+/// Fill the stack with a canary pattern (0xACE0BACE) so that we can identify unused stack memory
+/// in dumps & calculate stack usage. This is also really great (don't ask my why I know this) to identify
+/// when we tried executing stack memory.
+///
+/// # Safety
+///
+/// expects the bottom of the stack in `t0` and the top of stack in `sp`
+#[naked]
+unsafe extern "C" fn fill_stack() {
+    // Safety: inline assembly
+    unsafe {
+        naked_asm! {
+            // Fill the stack with a canary pattern (0xACE0BACE) so that we can identify unused stack memory
+            // in dumps & calculate stack usage. This is also really great (don't ask my why I know this) to identify
+            // when we tried executing stack memory.
+            "li     t1, 0xACE0BACE",
+            "1:",
+            "   sw          t1, 0(t0)",     // write the canary as u64
+            "   addi        t0, t0, 8",     // move to the next u64
+            "   bltu        t0, sp, 1b",    // loop until we reach the top of the stack
+            "ret"
+        }
+    }
+}
+
+/// This will hand off control over this CPU to the kernel. This is the last function executed in
+/// the loader and will never return.
+pub unsafe fn handoff_to_kernel(hartid: usize, boot_ticks: u64, init: &GlobalInitResult) -> ! {
+    let stack = init.stacks_alloc.region_for_hart(hartid);
+    let tls = init
+        .maybe_tls_alloc
+        .as_ref()
+        .map(|tls| tls.region_for_hart(hartid))
+        .unwrap_or_default();
+
     log::debug!("Hart {hartid} Jumping to kernel...");
-    log::trace!("Hart {hartid} entry: {entry:#x}, arguments: a0={hartid} a1={boot_info:?}");
+    log::trace!("Hart {hartid} entry: {:#x}, arguments: a0={hartid} a1={:?} stack={stack:#x?} tls={tls:#x?}", init.kernel_entry, init.boot_info);
+
+    // Synchronize all harts before jumping to the kernel.
+    // Technically this isn't really necessary, but debugging output gets horribly mangled if we don't
+    // and that's terrible for this critical transition
+    init.barrier.wait();
 
     // Safety: inline assembly
     unsafe {
         asm! {
+            "mv  sp, {stack_top}", // Set the kernel stack ptr
+            "mv  tp, {tls_start}", // Set the kernel thread ptr
+
+            // fill stack with canary pattern
+            // $sp is set to stack top above, $t0 is set to stack bottom by the asm args below
+            "call {fill_stack}",
+
             "mv ra, zero", // Reset return address
 
             "jalr zero, {kernel_entry}",
···
             "   wfi",
             "   j 1b",
             in("a0") hartid,
-            in("a1") boot_info,
-            kernel_entry = in(reg) entry,
+            in("a1") init.boot_info,
+            in("a2") boot_ticks,
+            in("t0") stack.start,
+            stack_top = in(reg) stack.end,
+            tls_start = in(reg) tls.start,
+            kernel_entry = in(reg) init.kernel_entry,
+            fill_stack = sym fill_stack,
             options(noreturn)
         }
     }
+}
+
+/// Start all secondary harts on the system as reported by [`MachineInfo`].
+pub fn start_secondary_harts(boot_hart: usize, minfo: &MachineInfo) -> crate::Result<()> {
+    let start = minfo.hart_mask.trailing_zeros() as usize;
+    let end = (usize::BITS - minfo.hart_mask.leading_zeros()) as usize;
+    log::trace!("{start}..{end}");
+
+    for hartid in start..end {
+        // Don't try to start ourselves
+        if hartid == boot_hart {
+            continue;
+        }
+
+        log::trace!("[{boot_hart}] starting hart {hartid}...");
+        riscv::sbi::hsm::start_hart(
+            hartid,
+            _start_secondary as usize,
+            minfo.fdt.as_ptr() as usize,
+        )
+        .map_err(Error::FailedToStartSecondaryHart)?;
+    }
+
+    Ok(())
 }
 
 pub unsafe fn map_contiguous(

loader/src/boot_info.rs

···
     loader_phys: Range<usize>,
     kernel_phys: Range<usize>,
     fdt_phys: Range<usize>,
-    boot_ticks: u64,
+    hart_mask: usize,
 ) -> crate::Result<*mut BootInfo> {
     let frame = frame_alloc
         .allocate_contiguous_zeroed(
···
     boot_info.tls_template = maybe_tls_template;
     boot_info.kernel_virt = kernel_virt;
     boot_info.kernel_phys = kernel_phys;
-    boot_info.boot_ticks = boot_ticks;
+    boot_info.hart_mask = hart_mask;
 
     let boot_info_ptr = page as *mut BootInfo;
     // Safety: we just allocated the boot info frame

loader/src/error.rs

···
     Elf(&'static str),
     /// The system was not able to allocate memory needed for the operation.
     NoMemory,
+    /// Failed to start secondary hart
+    #[cfg(any(target_arch = "riscv64", target_arch = "riscv32"))]
+    FailedToStartSecondaryHart(riscv::sbi::Error),
 }
 
 impl From<core::num::TryFromIntError> for Error {
···
             Error::TryFromInt(_) => write!(f, "Failed to convert number"),
             Error::Dtb(err) => write!(f, "Failed to parse device tree blob: {err}"),
             Error::Elf(err) => write!(f, "Failed to parse kernel elf: {err}"),
+            #[cfg(any(target_arch = "riscv64", target_arch = "riscv32"))]
+            Error::FailedToStartSecondaryHart(err) => {
+                write!(f, "Failed to start secondary hart: {err}")
+            }
         }
     }
 }

loader/src/machine_info.rs

···
 use crate::mapping::{align_down, checked_align_up};
 use arrayvec::ArrayVec;
 use core::cmp::Ordering;
-use core::ffi::c_void;
+use core::ffi::{c_void, CStr};
 use core::fmt;
 use core::fmt::Formatter;
 use core::range::Range;
···
     pub memories: ArrayVec<Range<usize>, 16>,
     /// The RNG seed passed to us by the previous stage loader.
     pub rng_seed: Option<&'dt [u8]>,
+    /// A bitfield where each bit corresponds to a CPU in the system.
+    /// A `1` bit indicates the CPU is "online" and can be used,
+    ///     while a `0` bit indicates the CPU is "offline" and can't be used by the system.
+    /// This is used across SBI calls to dispatch IPIs to the correct CPUs.
+    pub hart_mask: usize,
 }
 
 impl MachineInfo<'_> {
···
         let mut info = MachineInfo {
             fdt: fdt_slice,
             memories: v.memory_regions,
-            rng_seed: v.chosen_visitor.rng_seed,
+            rng_seed: v.chosen.rng_seed,
+            hart_mask: v.cpus.hart_mask,
         };
 
         let mut exclude_region = |entry: Range<usize>| {
···
         } else {
             writeln!(f, "{:<17} : None", "PRNG SEED")?;
         }
+        writeln!(f, "{:<17} : {:b}", "HART MASK", self.hart_mask)?;
 
         for (idx, r) in self.memories.iter().enumerate() {
             writeln!(f, "MEMORY REGION {:<4}: {}..{}", idx, r.start, r.end)?;
···
 #[derive(Default)]
 struct MachineInfoVisitor<'dt> {
     reservations: ReservationsVisitor<'dt>,
-    chosen_visitor: ChosenVisitor<'dt>,
+    chosen: ChosenVisitor<'dt>,
+    cpus: CpusVisitor,
     memory_regions: ArrayVec<Range<usize>, 16>,
     address_size: usize,
     width_size: usize,
···
         } else if name == "reserved-memory" {
             node.visit(&mut self.reservations)?;
         } else if name == "chosen" {
-            node.visit(&mut self.chosen_visitor)?;
+            node.visit(&mut self.chosen)?;
+        } else if name == "cpus" {
+            node.visit(&mut self.cpus)?;
         }
 
         Ok(())
···
         Ok(())
     }
 }
+
+#[derive(Default)]
+struct CpusVisitor {
+    hart_mask: usize,
+}
+
+impl CpusVisitor {
+    fn cpu_visitor(&self) -> CpuVisitor {
+        CpuVisitor::default()
+    }
+}
+
+impl<'dt> Visitor<'dt> for CpusVisitor {
+    type Error = dtb_parser::Error;
+
+    fn visit_subnode(&mut self, name: &'dt str, node: Node<'dt>) -> Result<(), Self::Error> {
+        if name.starts_with("cpu@") {
+            let mut v = self.cpu_visitor();
+            node.visit(&mut v)?;
+            let (hartid, enabled) = v.result();
+
+            if enabled {
+                self.hart_mask |= 1 << hartid;
+            }
+        }
+
+        Ok(())
+    }
+}
+
+#[derive(Default)]
+struct CpuVisitor<'dt> {
+    status: Option<&'dt CStr>,
+    hartid: usize,
+}
+
+impl CpuVisitor<'_> {
+    fn result(self) -> (usize, bool) {
+        let enabled = self.status.unwrap() != c"disabled";
+
+        (self.hartid, enabled)
+    }
+}
+
+impl<'dt> Visitor<'dt> for CpuVisitor<'dt> {
+    type Error = dtb_parser::Error;
+
+    fn visit_reg(&mut self, reg: &'dt [u8]) -> Result<(), Self::Error> {
+        self.hartid = match reg.len() {
+            4 => usize::try_from(u32::from_be_bytes(reg.try_into()?))?,
+            8 => usize::try_from(u64::from_be_bytes(reg.try_into()?))?,
+            _ => unreachable!(),
+        };
+
+        Ok(())
+    }
+
+    fn visit_property(&mut self, name: &'dt str, value: &'dt [u8]) -> Result<(), Self::Error> {
+        if name == "status" {
+            self.status = Some(CStr::from_bytes_until_nul(value)?);
+        }
+
+        Ok(())
+    }
+}

loader/src/main.rs

···
 #![feature(naked_functions)]
 #![feature(new_range_api)]
 #![feature(maybe_uninit_slice)]
+#![feature(alloc_layout_extra)]
 
 use crate::boot_info::prepare_boot_info;
 use crate::error::Error;
 use crate::frame_alloc::FrameAllocator;
 use crate::kernel::{parse_kernel, INLINED_KERNEL_BYTES};
 use crate::machine_info::MachineInfo;
-use crate::mapping::{identity_map_self, map_kernel, map_physical_memory};
+use crate::mapping::{
+    identity_map_self, map_kernel, map_kernel_stacks, map_physical_memory, StacksAllocation,
+    TlsAllocation,
+};
 use arrayvec::ArrayVec;
 use core::alloc::Layout;
 use core::ffi::c_void;
 use core::range::Range;
 use core::{ptr, slice};
+use sync::{Barrier, OnceLock};
 
 mod arch;
 mod boot_info;
···
 
 pub const ENABLE_KASLR: bool = false;
 pub const LOG_LEVEL: log::Level = log::Level::Trace;
+pub const STACK_SIZE: usize = 32 * arch::PAGE_SIZE;
 
 pub type Result<T> = core::result::Result<T, Error>;
 
···
 ///
 /// The passed `opaque` ptr must point to a valid memory region.
 unsafe fn main(hartid: usize, opaque: *const c_void, boot_ticks: u64) -> ! {
-    // zero out the BSS section
-    unsafe extern "C" {
-        static mut __bss_zero_start: u64;
-        static mut __bss_end: u64;
-    }
-    // Safety: Zero BSS section
+    static GLOBAL_INIT: OnceLock<GlobalInitResult> = OnceLock::new();
+    let res = GLOBAL_INIT.get_or_init(|| do_global_init(hartid, opaque));
+
+    // Enable the MMU on all harts. Note that this technically reenables it on the initializing hart
+    // but there is no harm in that.
+    // Safety: there is no safety
     unsafe {
-        let mut ptr = &raw mut __bss_zero_start;
-        let end = &raw mut __bss_end;
-        while ptr < end {
-            ptr.write_volatile(0);
-            ptr = ptr.offset(1);
-        }
+        log::trace!("activating MMU...");
+        arch::activate_aspace(res.root_pgtable);
+        log::trace!("activated.");
     }
 
+    if let Some(alloc) = &res.maybe_tls_alloc {
+        alloc.initialize_for_hart(hartid);
+    }
+
+    // Safety: this will jump to the kernel entry
+    unsafe { arch::handoff_to_kernel(hartid, boot_ticks, res) }
+}
+
+pub struct GlobalInitResult {
+    boot_info: *mut loader_api::BootInfo,
+    kernel_entry: usize,
+    root_pgtable: usize,
+    stacks_alloc: StacksAllocation,
+    maybe_tls_alloc: Option<TlsAllocation>,
+    barrier: Barrier,
+}
+
+// Safety: *mut BootInfo isn't Send but `GlobalInitResult` will only ever we read from, so this is fine.
+unsafe impl Send for GlobalInitResult {}
+// Safety: *mut BootInfo isn't Send but `GlobalInitResult` will only ever we read from, so this is fine.
+unsafe impl Sync for GlobalInitResult {}
+
+fn do_global_init(hartid: usize, opaque: *const c_void) -> GlobalInitResult {
     logger::init(LOG_LEVEL.to_level_filter());
-
     // Safety: TODO
     let minfo = unsafe { MachineInfo::from_dtb(opaque).expect("failed to parse machine info") };
     log::debug!("\n{minfo}");
 
-    let self_regions = SelfRegions::collect();
+    arch::start_secondary_harts(hartid, &minfo).unwrap();
+
+    let self_regions = SelfRegions::collect(&minfo);
     log::debug!("{self_regions:#x?}");
 
     // Initialize the frame allocator
···
     // print the elf sections for debugging purposes
     log::debug!("\n{kernel}");
 
-    let (kernel_virt, maybe_tls_template) = map_kernel(
+    let (kernel_virt, maybe_tls_alloc) = map_kernel(
         root_pgtable,
         &mut frame_alloc,
         &mut page_alloc,
         &kernel,
+        &minfo,
         phys_off,
     )
     .unwrap();
 
     log::trace!("KASLR: Kernel image at {:#x}", kernel_virt.start);
 
+    let stacks_alloc = map_kernel_stacks(
+        root_pgtable,
+        &mut frame_alloc,
+        &mut page_alloc,
+        &minfo,
+        usize::try_from(kernel._loader_config.kernel_stack_size_pages).unwrap(),
+        phys_off,
+    )
+    .unwrap();
+
     let frame_usage = frame_alloc.frame_usage();
     log::debug!(
         "Mapping complete, permanently used {} KiB.",
···
         phys_off,
         phys_map,
         kernel_virt,
-        maybe_tls_template,
+        maybe_tls_alloc.as_ref().map(|alloc| alloc.template.clone()),
         Range::from(self_regions.executable.start..self_regions.read_write.end),
         kernel_phys,
         fdt_phys,
-        boot_ticks,
+        minfo.hart_mask,
     )
     .unwrap();
 
···
         .checked_add(usize::try_from(kernel.elf_file.header.pt2.entry_point()).unwrap())
         .unwrap();
 
-    // Safety: this will jump to the kernel entry
-    unsafe { arch::handoff_to_kernel(hartid, boot_info, kernel_entry) }
+    GlobalInitResult {
+        boot_info,
+        kernel_entry,
+        root_pgtable,
+        maybe_tls_alloc,
+        stacks_alloc,
+        barrier: Barrier::new(minfo.hart_mask.count_ones() as usize),
+    }
 }
 
 #[derive(Debug)]
···
 }
 
 impl SelfRegions {
-    pub fn collect() -> Self {
+    pub fn collect(minfo: &MachineInfo) -> Self {
         unsafe extern "C" {
             static __text_start: u8;
             static __text_end: u8;
             static __rodata_start: u8;
             static __rodata_end: u8;
             static __bss_start: u8;
-            static __data_end: u8;
+            static __stack_start: u8;
         }
 
         SelfRegions {
···
             },
             read_write: Range {
                 start: &raw const __bss_start as usize,
-                end: &raw const __data_end as usize,
+                end: (&raw const __stack_start as usize)
+                    + (minfo.hart_mask.count_ones() as usize * STACK_SIZE),
             },
         }
     }

loader/src/mapping.rs

···
 use crate::{arch, SelfRegions};
 use bitflags::bitflags;
 use core::alloc::Layout;
-use core::num::NonZeroUsize;
+use core::num::{NonZero, NonZeroUsize};
 use core::range::Range;
-use core::{ptr, slice};
+use core::{cmp, ptr, slice};
 use loader_api::TlsTemplate;
 use xmas_elf::dynamic::Tag;
 use xmas_elf::program::{SegmentData, Type};
···
     frame_alloc: &mut FrameAllocator,
     page_alloc: &mut PageAllocator,
     kernel: &Kernel,
+    minfo: &MachineInfo,
     phys_off: usize,
-) -> crate::Result<(Range<usize>, Option<TlsTemplate>)> {
+) -> crate::Result<(Range<usize>, Option<TlsAllocation>)> {
     let kernel_virt = page_alloc.allocate(
         Layout::from_size_align(
             usize::try_from(kernel.mem_size())?,
···
             )?,
             Type::Tls => {
                 let ph = ProgramHeader::try_from(ph)?;
-                let old = maybe_tls_allocation.replace(TlsTemplate {
-                    start_addr: kernel_virt.start.checked_add(ph.virtual_address).unwrap(),
-                    mem_size: ph.mem_size,
-                    file_size: ph.file_size,
-                    align: ph.align,
-                });
+                let old = maybe_tls_allocation.replace(handle_tls_segment(
+                    root_pgtable,
+                    frame_alloc,
+                    page_alloc,
+                    &ph,
+                    kernel_virt.start,
+                    minfo,
+                    phys_off,
+                )?);
                 log::trace!("{maybe_tls_allocation:?}");
                 assert!(old.is_none(), "multiple TLS segments not supported");
             }
···
 ) -> crate::Result<()> {
     let flags = flags_for_segment(ph);
 
-    log::debug!(
+    log::trace!(
         "Handling Segment: LOAD off {offset:#016x} vaddr {vaddr:#016x} align {align} filesz {filesz:#016x} memsz {memsz:#016x} flags {flags:?}",
         offset = ph.offset,
         vaddr = ph.virtual_address,
···
 
     let data_bytes_before_zero = zero_start & 0xfff;
 
-    log::debug!(
+    log::trace!(
         "handling BSS {:#x?}, data bytes before {data_bytes_before_zero}",
         zero_start..zero_end
     );
···
                 data_bytes_before_zero,
             );
 
-            log::debug!("copying {data_bytes_before_zero} bytes from {src:p} to {dst:p}...");
+            log::trace!("copying {data_bytes_before_zero} bytes from {src:p} to {dst:p}...");
             ptr::copy_nonoverlapping(src.as_ptr(), dst.as_mut_ptr(), dst.len());
         }
 
···
             }
         }
         _ => unimplemented!("unsupported relocation type {}", rela.get_type()),
+    }
+}
+
+/// Map the kernel thread-local storage (TLS) memory regions.
+fn handle_tls_segment(
+    root_pgtable: usize,
+    frame_alloc: &mut FrameAllocator,
+    page_alloc: &mut PageAllocator,
+    ph: &ProgramHeader,
+    virt_base: usize,
+    minfo: &MachineInfo,
+    phys_off: usize,
+) -> crate::Result<TlsAllocation> {
+    let layout = Layout::from_size_align(ph.mem_size, cmp::max(ph.align, arch::PAGE_SIZE))
+        .unwrap()
+        .repeat(minfo.hart_mask.count_ones() as usize)
+        .unwrap()
+        .0
+        .pad_to_align();
+
+    let phys = frame_alloc
+        .allocate_contiguous_zeroed(layout, phys_off)
+        .unwrap();
+    let virt = page_alloc.allocate(layout);
+
+    log::trace!("Mapping TLS region {virt:#x?}...");
+    // Safety: Leaving the address space in an invalid state here is fine since on panic we'll
+    // abort startup anyway
+    unsafe {
+        arch::map_contiguous(
+            root_pgtable,
+            frame_alloc,
+            virt.start,
+            phys,
+            NonZero::new(layout.size()).unwrap(),
+            Flags::READ | Flags::WRITE,
+            phys_off,
+        )?;
+    }
+    log::trace!("here");
+
+    Ok(TlsAllocation {
+        virt,
+        template: TlsTemplate {
+            start_addr: virt_base + ph.virtual_address,
+            mem_size: ph.mem_size,
+            file_size: ph.file_size,
+            align: ph.align,
+        },
+    })
+}
+
+#[derive(Debug)]
+pub struct TlsAllocation {
+    /// The TLS region in virtual memory
+    virt: Range<usize>,
+    /// The template we allocated for
+    pub template: TlsTemplate,
+}
+
+impl TlsAllocation {
+    pub fn region_for_hart(&self, hartid: usize) -> Range<usize> {
+        let aligned_size = checked_align_up(
+            self.template.mem_size,
+            cmp::max(self.template.align, arch::PAGE_SIZE),
+        )
+        .unwrap();
+        let start = self.virt.start + (aligned_size * hartid);
+
+        Range::from(start..start + self.template.mem_size)
+    }
+
+    pub fn initialize_for_hart(&self, hartid: usize) {
+        if self.template.file_size != 0 {
+            // Safety: We have to trust the loaders BootInfo here
+            unsafe {
+                let src: &[u8] = slice::from_raw_parts(
+                    self.template.start_addr as *const u8,
+                    self.template.file_size,
+                );
+                let dst: &mut [u8] = slice::from_raw_parts_mut(
+                    self.region_for_hart(hartid).start as *mut u8,
+                    self.template.file_size,
+                );
+
+                // sanity check to ensure our destination allocated memory is actually zeroed.
+                // if it's not, that likely means we're about to override something important
+                debug_assert!(dst.iter().all(|&x| x == 0));
+
+                dst.copy_from_slice(src);
+            }
+        }
+    }
+}
+
+pub fn map_kernel_stacks(
+    root_pgtable: usize,
+    frame_alloc: &mut FrameAllocator,
+    page_alloc: &mut PageAllocator,
+    minfo: &MachineInfo,
+    per_hart_size_pages: usize,
+    phys_off: usize,
+) -> crate::Result<StacksAllocation> {
+    let per_hart_size = per_hart_size_pages * arch::PAGE_SIZE;
+    let layout = Layout::from_size_align(per_hart_size, arch::PAGE_SIZE)
+        .unwrap()
+        .repeat(minfo.hart_mask.count_ones() as usize)
+        .unwrap()
+        .0;
+
+    log::trace!("Allocating stack region {layout:?}...");
+
+    // The stacks region doesn't need to be zeroed, since we will be filling it with
+    // the canary pattern anyway
+    let phys = frame_alloc
+        .allocate_contiguous(layout)
+        .ok_or(Error::NoMemory)?;
+    let virt = page_alloc.allocate(layout);
+
+    log::trace!("Mapping stack region {virt:#x?}...");
+    // Safety: Leaving the address space in an invalid state here is fine since on panic we'll
+    // abort startup anyway
+    unsafe {
+        arch::map_contiguous(
+            root_pgtable,
+            frame_alloc,
+            virt.start,
+            phys,
+            NonZero::new(layout.size()).unwrap(),
+            Flags::READ | Flags::WRITE,
+            phys_off,
+        )?;
+    }
+
+    Ok(StacksAllocation {
+        virt,
+        per_hart_size,
+    })
+}
+
+pub struct StacksAllocation {
+    /// The TLS region in virtual memory
+    virt: Range<usize>,
+    per_hart_size: usize,
+}
+
+impl StacksAllocation {
+    pub fn region_for_hart(&self, hartid: usize) -> Range<usize> {
+        let end = self.virt.end - (self.per_hart_size * hartid);
+
+        Range::from((end - self.per_hart_size)..end)
     }
 }