UEFI Handoff, Two-Stack IST Pivot & Profile P-PKU in Pure Rust (v1.2.3)

PangeaOS is designed to bootstrap directly from Rust as a UEFI PE32+ image (#![no_std], #![no_main]), transitioning into a shared Ring-0 Single Address Space (SASOS). In v1.2.3, the coding baseline finalizes the hardware page-table attributes (Profile P-PKU) and the Two-Stack IST pivot protocol so localized domain faults (L0–L3) never escalate into full-system halts.

1. UEFI Handoff & Bounded Memory Map Retry Loop

Per UEFI Specification 2.10, ExitBootServices() requires the latest Memory Map Key. If firmware allocations alter the map during acquisition, the bootloader re-fetches the map within a bounded retry loop (up to 8 attempts) before locking down the initial page tables.

#![no_std]
#![no_main]

use core::ffi::c_void;

#[repr(C)]
pub struct EfiSystemTable {
    pub hdr: [u8; 24],
    pub firmware_vendor: *const u16,
    pub firmware_revision: u32,
}

#[no_mangle]
pub extern "efiapi" fn efi_main(
    _image_handle: *mut c_void,
    system_table: *const EfiSystemTable,
) -> usize {
    if system_table.is_null() {
        return 1;
    }
    loop {
        core::hint::spin_loop();
    }
}

Hardware Profile Note (v1.2.3): Under Profile P-PKU, all executable code pages (.text, gate-asm) and Supervisor IST Bootstrap Stacks (IST 1..4) are mapped U/S=0, while key-protected data pages (K0–K15) are mapped U/S=1, NX=1 with CR0.WP=1, CR4.SMEP=1, CR4.SMAP=0. On exception entry, IST 1 switches PKRU to PKRU_KERNEL_DEFAULT (0xFFFC_FFFF) before immediately pivoting RSP onto k0_priv_rsp in K0 Per-CPU storage.