feat(exec): Run userland in ring 3 with an ELF64 loader and per-process page tables

SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.

Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
  rest empty, so userland is given its own PML4 slot (512 GiB) rather than
  holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
  entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
  unmapped pointer; lifting that needs a recursive map or a higher-half
  direct map, which is noted in the file.

ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
  header against both the image and the user address range, and lays PT_LOAD
  segments into an address space. Frames arrive zeroed, so .bss is covered.

Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
  user_return() unwinds back to it when the process exits, so exec looks like
  a call that blocks until the program finishes.

Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
  The process gets its own kernel stack for the trap, because TSS.rsp0 must
  not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
  still live during a syscall, so without that check a program could pass a
  kernel address and have write(2) dump kernel text to the console. The new
  /sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
  reuses printk's routing so output reaches serial and the framebuffer
  console rather than only the VGA text buffer.

Faults
- A ring 3 exception now kills that process and reports CR2 instead of
  panicking the machine.

Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
  base and embedded in the kernel image by scripts/mkblob.py. It reports its
  pid, verifies .bss was zeroed and .data is writable, checks the two pointer
  rejections, and exits.

aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.

Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

include/kernel/elf.h

@@ -0,0 +1,98 @@
+#ifndef _KERNEL_ELF_H
+#define _KERNEL_ELF_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <mm/vmspace.h>
+
+/* ELF64 object file format, as far as a static executable needs it. */
+
+typedef uint64_t Elf64_Addr;
+typedef uint64_t Elf64_Off;
+typedef uint16_t Elf64_Half;
+typedef uint32_t Elf64_Word;
+typedef uint64_t Elf64_Xword;
+
+#define EI_NIDENT 16
+
+typedef struct {
+    unsigned char e_ident[EI_NIDENT];
+    Elf64_Half    e_type;
+    Elf64_Half    e_machine;
+    Elf64_Word    e_version;
+    Elf64_Addr    e_entry;
+    Elf64_Off     e_phoff;
+    Elf64_Off     e_shoff;
+    Elf64_Word    e_flags;
+    Elf64_Half    e_ehsize;
+    Elf64_Half    e_phentsize;
+    Elf64_Half    e_phnum;
+    Elf64_Half    e_shentsize;
+    Elf64_Half    e_shnum;
+    Elf64_Half    e_shstrndx;
+} __attribute__((packed)) Elf64_Ehdr;
+
+typedef struct {
+    Elf64_Word  p_type;
+    Elf64_Word  p_flags;
+    Elf64_Off   p_offset;
+    Elf64_Addr  p_vaddr;
+    Elf64_Addr  p_paddr;
+    Elf64_Xword p_filesz;
+    Elf64_Xword p_memsz;
+    Elf64_Xword p_align;
+} __attribute__((packed)) Elf64_Phdr;
+
+/* e_ident indices and values */
+#define EI_CLASS      4
+#define EI_DATA       5
+#define EI_VERSION    6
+#define ELFCLASS64    2
+#define ELFDATA2LSB   1
+#define EV_CURRENT    1
+
+/* e_type */
+#define ET_EXEC       2
+#define ET_DYN        3
+
+/* e_machine */
+#define EM_X86_64     62
+#define EM_AARCH64    183
+#define EM_ARM        40
+
+/* p_type */
+#define PT_NULL       0
+#define PT_LOAD       1
+#define PT_DYNAMIC    2
+#define PT_INTERP     3
+#define PT_NOTE       4
+#define PT_PHDR       6
+#define PT_GNU_STACK  0x6474e551
+
+/* p_flags */
+#define PF_X          0x1
+#define PF_W          0x2
+#define PF_R          0x4
+
+/* elf_load return codes */
+#define ELF_OK             0
+#define ELF_ETRUNCATED    -1   /* image smaller than the headers claim */
+#define ELF_EMAGIC        -2   /* not an ELF file */
+#define ELF_ECLASS        -3   /* not ELF64 little-endian */
+#define ELF_ETYPE         -4   /* not a static executable */
+#define ELF_EMACHINE      -5   /* built for another architecture */
+#define ELF_ERANGE        -6   /* a segment falls outside the user range */
+#define ELF_ENOMEM        -7   /* out of physical pages */
+#define ELF_ENOENTRY      -8   /* entry point is not inside any PT_LOAD */
+
+const char* elf_strerror(int err);
+
+/*
+ * Parse a static ELF64 executable held in kernel memory and lay its PT_LOAD
+ * segments into `vm`. On success *entry_out receives e_entry and *brk_out the
+ * page-aligned end of the highest segment, which is where the heap starts.
+ */
+int elf_load(vmspace_t* vm, const void* image, size_t len,
+             uint64_t* entry_out, uint64_t* brk_out);
+
+#endif /* _KERNEL_ELF_H */

include/kernel/exec.h

@@ -0,0 +1,53 @@
+#ifndef _KERNEL_EXEC_H
+#define _KERNEL_EXEC_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <kernel/types.h>
+#include <mm/vmspace.h>
+
+/* A process running in ring 3. */
+typedef struct uproc {
+    pid_t      pid;
+    char       name[32];
+    vmspace_t* vm;
+    uint64_t   entry;
+    uint64_t   brk;        /* program break, grown by SYS_brk */
+    uint64_t   brk_start;  /* end of the loaded image */
+    uint64_t   kstack;     /* kernel stack used for traps out of ring 3 */
+    size_t     kstack_size;
+    int        exit_code;
+    bool       exited;
+} uproc_t;
+
+/* The process currently executing in ring 3, or NULL in plain kernel context. */
+uproc_t* uproc_current(void);
+
+/*
+ * Load a static ELF64 image and run it in ring 3. Blocks until the process
+ * exits and returns its exit status, or a negative value if it could not be
+ * started. `image` must stay valid for the lifetime of the call.
+ */
+int exec_user_image(const char* name, const void* image, size_t len);
+
+/* Terminate the running process and unwind back into exec_user_image(). */
+void uproc_exit(int status) __attribute__((noreturn));
+
+/*
+ * Abort the running process because it faulted. Safe to call from an
+ * exception handler; does not return.
+ */
+void uproc_fault(const char* reason, uint64_t addr) __attribute__((noreturn));
+
+/* Bounds-checked transfers between the kernel and the running process. */
+bool uaccess_ok(uint64_t uaddr, size_t len);
+int  uaccess_copy_from_user(void* dst, uint64_t usrc, size_t len);
+int  uaccess_copy_to_user(uint64_t udst, const void* src, size_t len);
+/* Copy a NUL-terminated user string; returns its length or -1. */
+long uaccess_copy_string(char* dst, uint64_t usrc, size_t max);
+
+/* Run the built-in /sbin/init image. Returns its exit status. */
+int exec_run_builtin_init(void);
+
+#endif /* _KERNEL_EXEC_H */

include/kernel/printk.h

@@ -43,6 +43,10 @@
 
 // Printk API
 void printk_init(void);
+
+// Write raw bytes to every console printk drives (TTY or framebuffer, plus
+// serial). Used by the write(2) path so userland output is routed identically.
+void console_write(const char* data, size_t len);
 int  printk(const char* fmt, ...);
 int  vprintk(const char* fmt, va_list args);
 int  kprintf(const char* fmt, ...); // Alias for compatibility

include/mm/vmspace.h

@@ -0,0 +1,67 @@
+#ifndef _MM_VMSPACE_H
+#define _MM_VMSPACE_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+/*
+ * Per-process address spaces.
+ *
+ * The boot page tables identity-map the low 4 GB with 2 MB supervisor pages
+ * hanging off PML4[0], and leave PML4[1..511] empty. Userland is therefore
+ * given its own PML4 slot rather than carving holes out of the kernel's
+ * identity map: a process PML4 shares entry 0 with the kernel (so ring 0 can
+ * still reach every kernel address after the CR3 switch) and privately owns
+ * entry 1, which is where every user mapping lives.
+ */
+#define USER_PML4_SLOT    1UL
+#define USER_BASE         (USER_PML4_SLOT << 39)               /* 512 GiB      */
+#define USER_SPAN         (1UL << 39)                          /* 512 GiB      */
+#define USER_LIMIT        (USER_BASE + USER_SPAN)
+
+#define USER_LOAD_BASE    (USER_BASE + 0x400000UL)             /* +4 MiB       */
+#define USER_STACK_TOP    (USER_BASE + 0x08000000UL)           /* +128 MiB     */
+#define USER_STACK_PAGES  16UL                                 /* 64 KiB stack */
+
+#define VM_PAGE_SIZE      4096UL
+
+/* vmspace_map / vmspace_alloc protection flags (arch-neutral). */
+#define VM_PROT_READ      0x1
+#define VM_PROT_WRITE     0x2
+#define VM_PROT_EXEC      0x4
+#define VM_PROT_USER      0x8
+
+typedef struct vmspace vmspace_t;
+
+/* Create an address space that shares the kernel's mappings. NULL on OOM. */
+vmspace_t* vmspace_create(void);
+
+/* Release every page and page table the space privately owns. */
+void vmspace_destroy(vmspace_t* vm);
+
+/* Map one already-allocated physical page. Returns 0 or a negative errno. */
+int vmspace_map_page(vmspace_t* vm, uint64_t virt, uint64_t phys, int prot);
+
+/*
+ * Allocate zeroed physical pages and map [virt, virt+len) with them.
+ * `virt` and `len` need not be page aligned; the covered range is rounded out.
+ */
+int vmspace_alloc(vmspace_t* vm, uint64_t virt, size_t len, int prot);
+
+/* Copy kernel memory into an already-mapped user range. */
+int vmspace_write(vmspace_t* vm, uint64_t dst, const void* src, size_t len);
+
+/* Translate a user virtual address to a physical one, or 0 if unmapped. */
+uint64_t vmspace_resolve(vmspace_t* vm, uint64_t virt);
+
+/* Install this address space on the current CPU. */
+void vmspace_switch(vmspace_t* vm);
+
+/* True when the whole range is mapped and reachable from ring 3. */
+bool vmspace_range_ok(vmspace_t* vm, uint64_t virt, size_t len);
+
+/* Pages currently charged to this address space. */
+uint64_t vmspace_resident_pages(vmspace_t* vm);
+
+#endif /* _MM_VMSPACE_H */