feat(exec): Run userland in ring 3 with an ELF64 loader and per-process page tables

SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.

Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
  rest empty, so userland is given its own PML4 slot (512 GiB) rather than
  holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
  entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
  unmapped pointer; lifting that needs a recursive map or a higher-half
  direct map, which is noted in the file.

ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
  header against both the image and the user address range, and lays PT_LOAD
  segments into an address space. Frames arrive zeroed, so .bss is covered.

Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
  user_return() unwinds back to it when the process exits, so exec looks like
  a call that blocks until the program finishes.

Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
  The process gets its own kernel stack for the trap, because TSS.rsp0 must
  not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
  still live during a syscall, so without that check a program could pass a
  kernel address and have write(2) dump kernel text to the console. The new
  /sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
  reuses printk's routing so output reaches serial and the framebuffer
  console rather than only the VGA text buffer.

Faults
- A ring 3 exception now kills that process and reports CR2 instead of
  panicking the machine.

Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
  base and embedded in the kernel image by scripts/mkblob.py. It reports its
  pid, verifies .bss was zeroed and .data is writable, checks the two pointer
  rejections, and exits.

aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.

Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

Makefile

@@ -127,6 +127,7 @@ CORE_SRCS = kernel/main.c kernel/task.c kernel/sync.c kernel/timer.c kernel/prin
             kernel/signal.c kernel/workqueue.c kernel/tsc.c kernel/vt_art.c \
             kernel/sub/sub_runtime.c kernel/sub/sub_vm.c \
             kernel/wait.c kernel/futex.c kernel/rcu.c kernel/ktest.c \
+            kernel/elf.c kernel/exec.c \
             lib/string.c lib/vsprintf.c lib/bitmap.c lib/rbtree.c lib/kfifo.c lib/hashtable.c lib/font8x8.c \
             init/cmdline.c init/service.c init/bootlogo.c init/logo_data.c usr/initramfs.c block/block.c block/elevator.c \
             ipc/sem.c ipc/shm.c ipc/shm_posix.c ipc/pipe.c ipc/ipc.c ipc/msg.c \
@@ -301,7 +302,16 @@ ifeq ($(ARCH), x86_64)
     ALL_C_SRCS = $(ARCH_C_SRCS) $(CONFIG_SRCS-y)
     C_OBJS = $(patsubst %.c, $(BUILD_DIR)/%.o, $(ALL_C_SRCS))
     ASM_OBJS   = $(patsubst %.asm, $(BUILD_DIR)/%.o, $(ARCH_ASM_SRCS))
-    OTHER_OBJS = $(filter-out $(ENTRY_OBJ), $(ASM_OBJS) $(C_OBJS)) $(CPP_OBJS) $(RUST_LIB)
+
+    # Userland /sbin/init, linked separately and carried inside the kernel image.
+    INIT_SRC      = userland/init/init.c
+    INIT_LD       = userland/init/user.ld
+    INIT_OBJ      = $(BUILD_DIR)/userland/init/init.o
+    INIT_ELF      = $(BUILD_DIR)/userland/init/init.elf
+    INIT_BLOB_SRC = $(BUILD_DIR)/usr/init_blob.c
+    INIT_BLOB_OBJ = $(BUILD_DIR)/usr/init_blob.o
+
+    OTHER_OBJS = $(filter-out $(ENTRY_OBJ), $(ASM_OBJS) $(C_OBJS)) $(CPP_OBJS) $(INIT_BLOB_OBJ) $(RUST_LIB)
 else
     CONFIG_SRCS-y += rust/rust_fallback.c kernel/cpp/cpp_fallback.c
     ALL_C_SRCS = $(ARCH_C_SRCS) $(CONFIG_SRCS-y)
@@ -366,6 +376,33 @@ $(BUILD_DIR)/%.o: %.S
 	@mkdir -p $(dir $@)
 	$(CC) $(CFLAGS) $(DEPFLAGS) -c $< -o $@
 
+# Userland Program Compilation
+#
+# /sbin/init is a separate freestanding executable, not kernel code: it is
+# linked at the user base from userland/user.ld and must never see the kernel's
+# -mcmodel=kernel, which cannot reach the user half of the address space.
+USER_CFLAGS = -ffreestanding -nostdlib -fno-pie -fno-pic -mno-red-zone \
+              -mcmodel=large -mno-sse -mno-mmx -mno-sse2 \
+              -Wall -Wextra -Wno-unused-function \
+              $(if $(CONFIG_OPTIMIZATION),$(CONFIG_OPTIMIZATION),-O2)
+
+$(INIT_OBJ): $(INIT_SRC)
+	@mkdir -p $(dir $@)
+	$(CC) $(USER_CFLAGS) -c $< -o $@
+
+$(INIT_ELF): $(INIT_OBJ) $(INIT_LD)
+	@mkdir -p $(dir $@)
+	$(LD) -nostdlib -no-pie -T $(INIT_LD) -o $@ $(INIT_OBJ)
+	@echo "=== [Userland init linked: $@] ==="
+
+$(INIT_BLOB_SRC): $(INIT_ELF) scripts/mkblob.py
+	@mkdir -p $(dir $@)
+	@python3 scripts/mkblob.py $(INIT_ELF) $@ subos_init_elf
+
+$(INIT_BLOB_OBJ): $(INIT_BLOB_SRC) include/config/autoconf.h
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -c $< -o $@
+
 # Rust Source Compilation
 $(RUST_LIB): rust/src/lib.rs $(RUST_SRCS)
 	@mkdir -p $(dir $@)