uint32 user_code[2]={
      0x00000073, // ecall
      0x0000006f  // j .
}

  .section .text
  .global uservec
  .align 2
uservec:
  # 1. exchange stack. After this, sp=kernel stack, sscratch=user stack
  csrrw sp, sscratch, sp

  # 2. allocate trapframe
  addi sp, sp, -256

  # 3. save t0, because we need to use it to save user sp
  sd t0, 32(sp)

  # 4. save user sp to trapframe
  csrr t0, sscratch
  sd t0, 8(sp)

  # 5. save the registers.
  sd ra, 0(sp)
  sd gp, 16(sp)
  ... 
  sd t6, 240(sp)

  call usertrap

# ==========================================

.global userret
userret:
  mv sp, a0

  addi t0, sp, 256
  csrw sscratch, t0

  # start restore except a0 and sp
  ld ra, 0(sp)
  ld gp, 16(sp)
  ...
  ld t6, 240(sp)

  # first restore a0, then restore sp that points to trapframe
  ld a0, 72(sp)

  # finally restore sp
  ld sp, 8(sp)

  sret

struct trapframe{
  uint64 ra;
  uint64 sp;
  ...
  uint64 t6;

  // other value
  uint64 epc;
}

void usertrap(void) {
  // LOG_TRACE("usertrap");
  if ((r_sstatus() & SSTATUS_U_SPP) != 0) {
    panic("usertrap: not from user mode");
  }
  // write kernel trap vector that handles new interrupts in S mode
  trapinit();

  uint64 sp = r_sp();
  struct trapframe *tf =
      (struct trapframe *)(PGROUNDUP(sp) - sizeof(struct trapframe));

  mytrapframe = tf;

  tf->epc = (uint64)r_sepc();

  uint64 cause = r_scause();

  if ((cause >> 63) == 1) {
    uint64 exception_code = cause & ((1ULL << 63) - 1);
    if (exception_code == E_S_TIMER_INTERRUPT) {
      sbi_set_timer(r_time() + 1000000);
      yield();
      LOG_TRACE("Tick in U-mode");
    } else {
      LOG_ERROR("Unexpected interrupt in U-mode, code: %d", exception_code);
    }
  } else {
    if (cause == 8) {
      LOG_INFO("Target Eliminated: Successfully executed 'ecall' in U-mode!");
      syscall();
      tf->epc += 4;

      // test can the value be passed normally
      LOG_DEBUG("tf-a2: %d", tf->a2);
    } else {
      LOG_ERROR("Unexpected trap, cause: %d", cause);
      while (1)
        ;
    }
  }

  usertrapret();
}

void usertrapret(void) {
  // LOG_TRACE("usertrapret");
  // Set SIP that turns off all interrupts
  intr_off();

  // write kernel trap vector
  extern void uservec(void);
  w_stvec((uint64)uservec);

  // set S Previous Privilege mode to User.
  unsigned long x = r_sstatus();
  x &= ~SSTATUS_U_SPP; // clear SPP to 0 for user mode
  x |= SSTATUS_SPIE;   // enable interrupts in user mode
  w_sstatus(x);

  w_sepc(mytrapframe->epc);

  extern void userret(struct trapframe *);
  userret(mytrapframe);
}

static pagetable_t create_user_pagetable() {
  pagetable_t user_pagetable = (pagetable_t)kalloc();
  if (user_pagetable == 0) {
    panic("Failed to allocate memory");
  }

  memset(user_pagetable, 0, PGSIZE);

  // mapping kernel pagetable
  for (int i = 256; i < 512; i++) {
    extern pagetable_t kernel_table;
    user_pagetable[i] = kernel_table[i];
  }

  return user_pagetable;
}

uint64 user_code[2]={
  0x00000073, // ecall
  0x0000006f  // j .
}

void user_init() {
  LOG_TRACE("Initializing user process");
  struct Process *p = alloc_process();
  if (p == 0) {
    panic("Failed to allocate process");
  }

  uint64 user_code_table = (uint64)kalloc();
  if (user_code_table == 0) {
    panic("Failed to allocate memory");
  }
  uint64 user_stack = (uint64)kalloc();
  if (user_stack == 0) {
    panic("Failed to allocate memory");
  }
  uint32 user_code[4] = {
      0x00100893, // addi a7, zero, 1
      0x06300513, // addi a0, zero, 99
      0x00000073, // ecall
      0x0000006f  // j .
  };
  memcpy((uint64 *)user_code_table, user_code, 16);

  kvmmap(p->pagetable, 0x0, (uint64)ADR2LOW(user_code_table), PGSIZE,
         PTE_U | PTE_R | PTE_W | PTE_X | PTE_V);
  uint64 user_stack_va = 0x40000;
  kvmmap(p->pagetable, (uint64)user_stack_va, (uint64)ADR2LOW(user_stack),
         PGSIZE, PTE_U | PTE_R | PTE_W | PTE_V);

  uint64 user_stack_top = (uint64)user_stack_va + PGSIZE;
  p->trapframe->sp = user_stack_top;
  p->trapframe->epc = 0x0;

  // Test whether it can be stored in order normally
  p->trapframe->a2 = 666;

  p->state = RUNNABLE;
  LOG_TRACE("User process initialized");
}

struct context {
  uint64 ra;
  uint64 sp;

  // callee-saved
  uint64 s0;
  ...
  uint64 s11;
};

struct Process {
  enum proc_state state;
  int pid;       // Process ID
  char name[16]; // Process name

  uint64 kstack;               // Kernel stack pointer
  pagetable_t pagetable;       // Page tabl
  struct context *context;     // Kernel context
  struct trapframe *trapframe; // User trap frame
};

.globl swtch
swtch:
        sd ra, 0(a0)
        sd sp, 8(a0)
        sd s0, 16(a0)
        sd s1, 24(a0)
        ...
        sd s11, 104(a0)

        ld ra, 0(a1)
        ld sp, 8(a1)
        ld s0, 16(a1)
        ld s1, 24(a1)
        ...
        ld s11, 104(a1)

        ret

struct Process *alloc_process(void) {
  struct Process *p;
  for (p = proc; p < &proc[64]; p++) {
    if (p->state == UNUSED) {
      p->state = USED;
      p->kstack = (uint64)kalloc();
      p->pagetable = create_user_pagetable();

      // NOTE:
      // Position the trapframe above the stack, that is, at a lower address
      // in order to store data in the tramframe
      p->trapframe = (struct trapframe *)(p->kstack - sizeof(struct trapframe));

      extern void usertrapret(void);
      // NOTE: p->context must be allocated in the kernel otherwise it will be
      // panic
      p->context = (struct context *)kalloc();
      p->context->ra = (uint64)usertrapret;

      // NOTE:
      // Point sp to a location not used by the trapframe
      p->context->sp = p->kstack + PGSIZE - sizeof(struct trapframe);
      return p;
    }
  }
  return 0;
}

  uint64 sp = r_sp();
  struct trapframe *tf =
      (struct trapframe *)(PGROUNDUP(sp) - sizeof(struct trapframe));

p->kstack (Low Address)
  +---------------------------+ <--- 栈底 (Low Address)
  |      (空闲空间)           |
  +---------------------------+ <--- p->trapframe 指针指向这里
  |                           |
  |      struct trapframe     |  <--- 用于存放用户态现场 (U-mode registers)
  |    (epc, ra, sp, ...)     |
  |                           |
  +---------------------------+ <--- p->context->sp (指向 trapframe 底部下方)
  |      (空闲/运行空间)       |
  |      Kernel Stack         |
  |                           |
  +---------------------------+ <--- 栈顶 (p->kstack + PGSIZE, High Address)

void scheduler(void) {
  struct Process *p;
  extern void swtch(struct context * old, struct context * new);

  for (;;) {
    for (p = proc; p < &proc[64]; p++) {
      if (p->state == RUNNABLE) {
        p->state = RUNNING;
        current_proc = p;

        extern struct trapframe *mytrapframe;
        mytrapframe = p->trapframe;

        // NOTE:
        // Because in uservec, addi sp, sp, -256 is first used, uservec can
        // properly align with the trapframe and store data into it.
        w_sscratch(p->kstack + PGSIZE);

        w_satp(MAKE_SATP(ADR2LOW((uint64)p->pagetable)));
        sfence_vma();

        swtch(&scheduler_context, p->context);

        current_proc = 0;
        extern pagetable_t kernel_table;
        w_satp(MAKE_SATP(kernel_table));
        sfence_vma();

        LOG_TRACE("Switched back to kernel");
      }
    }
  }
  LOG_TRACE("Scheduler done");
}