feat(exec): Run userland in ring 3 with an ELF64 loader and per-process page tables

SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.

Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
  rest empty, so userland is given its own PML4 slot (512 GiB) rather than
  holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
  entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
  unmapped pointer; lifting that needs a recursive map or a higher-half
  direct map, which is noted in the file.

ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
  header against both the image and the user address range, and lays PT_LOAD
  segments into an address space. Frames arrive zeroed, so .bss is covered.

Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
  user_return() unwinds back to it when the process exits, so exec looks like
  a call that blocks until the program finishes.

Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
  The process gets its own kernel stack for the trap, because TSS.rsp0 must
  not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
  still live during a syscall, so without that check a program could pass a
  kernel address and have write(2) dump kernel text to the console. The new
  /sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
  reuses printk's routing so output reaches serial and the framebuffer
  console rather than only the VGA text buffer.

Faults
- A ring 3 exception now kills that process and reports CR2 instead of
  panicking the machine.

Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
  base and embedded in the kernel image by scripts/mkblob.py. It reports its
  pid, verifies .bss was zeroed and .data is writable, checks the two pointer
  rejections, and exits.

aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.

Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

kernel/elf.c

@@ -0,0 +1,116 @@
+#include <kernel/elf.h>
+#include <kernel/printk.h>
+#include <lib/string.h>
+#include <mm/vmspace.h>
+
+#if defined(__x86_64__)
+#define ELF_NATIVE_MACHINE EM_X86_64
+#elif defined(__aarch64__)
+#define ELF_NATIVE_MACHINE EM_AARCH64
+#else
+#define ELF_NATIVE_MACHINE EM_ARM
+#endif
+
+static const char* const elf_errors[] = {
+    [0]                = "ok",
+    [-ELF_ETRUNCATED]  = "image is truncated",
+    [-ELF_EMAGIC]      = "not an ELF object",
+    [-ELF_ECLASS]      = "not a little-endian ELF64 object",
+    [-ELF_ETYPE]       = "not a static executable",
+    [-ELF_EMACHINE]    = "built for a different architecture",
+    [-ELF_ERANGE]      = "segment falls outside the user address range",
+    [-ELF_ENOMEM]      = "out of memory",
+    [-ELF_ENOENTRY]    = "entry point is not inside a loadable segment",
+};
+
+const char* elf_strerror(int err) {
+    unsigned idx = (unsigned)(-err);
+    if (err > 0 || idx >= sizeof(elf_errors) / sizeof(elf_errors[0]) || !elf_errors[idx]) {
+        return "unknown error";
+    }
+    return elf_errors[idx];
+}
+
+static int elf_prot_of(Elf64_Word p_flags) {
+    int prot = VM_PROT_USER;
+    if (p_flags & PF_R) prot |= VM_PROT_READ;
+    if (p_flags & PF_W) prot |= VM_PROT_WRITE;
+    if (p_flags & PF_X) prot |= VM_PROT_EXEC;
+    return prot;
+}
+
+static int elf_check_header(const Elf64_Ehdr* eh, size_t len) {
+    if (len < sizeof(Elf64_Ehdr)) return ELF_ETRUNCATED;
+
+    if (eh->e_ident[0] != 0x7F || eh->e_ident[1] != 'E' ||
+        eh->e_ident[2] != 'L'  || eh->e_ident[3] != 'F') {
+        return ELF_EMAGIC;
+    }
+    if (eh->e_ident[EI_CLASS] != ELFCLASS64 ||
+        eh->e_ident[EI_DATA]  != ELFDATA2LSB) {
+        return ELF_ECLASS;
+    }
+    /* Only static executables: a PT_INTERP image would need a loader we have
+     * no business running this early. */
+    if (eh->e_type != ET_EXEC) return ELF_ETYPE;
+    if (eh->e_machine != ELF_NATIVE_MACHINE) return ELF_EMACHINE;
+    if (eh->e_phnum == 0 || eh->e_phentsize != sizeof(Elf64_Phdr)) return ELF_ETRUNCATED;
+
+    /* The program header table itself has to be inside the image. */
+    uint64_t ph_bytes = (uint64_t)eh->e_phnum * eh->e_phentsize;
+    if (eh->e_phoff > len || ph_bytes > len - eh->e_phoff) return ELF_ETRUNCATED;
+
+    return ELF_OK;
+}
+
+int elf_load(vmspace_t* vm, const void* image, size_t len,
+             uint64_t* entry_out, uint64_t* brk_out) {
+    if (!vm || !image) return ELF_EMAGIC;
+
+    const Elf64_Ehdr* eh = (const Elf64_Ehdr*)image;
+    int err = elf_check_header(eh, len);
+    if (err != ELF_OK) return err;
+
+    const Elf64_Phdr* ph = (const Elf64_Phdr*)((const uint8_t*)image + eh->e_phoff);
+    uint64_t brk = 0;
+    bool entry_mapped = false;
+
+    for (Elf64_Half i = 0; i < eh->e_phnum; i++) {
+        const Elf64_Phdr* p = &ph[i];
+        if (p->p_type != PT_LOAD || p->p_memsz == 0) continue;
+
+        /* A segment may declare more memory than it stores (.bss), but never
+         * less, and its file image must lie inside the blob we were handed. */
+        if (p->p_filesz > p->p_memsz) return ELF_ETRUNCATED;
+        if (p->p_offset > len || p->p_filesz > len - p->p_offset) return ELF_ETRUNCATED;
+
+        /* Keep every mapping inside the slot reserved for userland, and reject
+         * a length that would wrap past the top of the address space. */
+        if (p->p_vaddr < USER_BASE) return ELF_ERANGE;
+        if (p->p_memsz > USER_LIMIT - p->p_vaddr) return ELF_ERANGE;
+
+        err = vmspace_alloc(vm, p->p_vaddr, p->p_memsz, elf_prot_of(p->p_flags));
+        if (err != 0) return ELF_ENOMEM;
+
+        if (p->p_filesz) {
+            err = vmspace_write(vm, p->p_vaddr,
+                                (const uint8_t*)image + p->p_offset, p->p_filesz);
+            if (err != 0) return ELF_ENOMEM;
+        }
+        /* vmspace_alloc hands back zeroed pages, so .bss needs no extra work. */
+
+        uint64_t seg_end = p->p_vaddr + p->p_memsz;
+        if (seg_end > brk) brk = seg_end;
+
+        if (eh->e_entry >= p->p_vaddr && eh->e_entry < seg_end) entry_mapped = true;
+    }
+
+    if (!brk) return ELF_ERANGE;
+    if (!entry_mapped) return ELF_ENOENTRY;
+
+    if (entry_out) *entry_out = eh->e_entry;
+    if (brk_out) {
+        *brk_out = (brk + VM_PAGE_SIZE - 1) & ~(VM_PAGE_SIZE - 1);
+    }
+    return ELF_OK;
+}

kernel/exec.c

@@ -0,0 +1,238 @@
+#include <kernel/exec.h>
+#include <kernel/elf.h>
+#include <kernel/printk.h>
+#include <kernel/panic.h>
+#include <kernel/task.h>
+#include <mm/vmspace.h>
+#include <mm/kmalloc.h>
+#include <lib/string.h>
+
+#if defined(__x86_64__)
+#include <arch/x86_64/gdt.h>
+
+/* Implemented in arch/x86_64/cpu/usermode.asm. */
+extern int64_t user_enter(uint64_t entry, uint64_t user_rsp);
+extern void    user_return(int64_t status) __attribute__((noreturn));
+
+#define USER_KSTACK_SIZE 16384
+
+static uproc_t* current_uproc = NULL;
+
+/*
+ * User processes carry their own pid namespace for now. They are not backed by
+ * a task_struct yet, so borrowing task_get_pid() would report the idle task's
+ * pid 0 to every program that asked.
+ */
+static pid_t next_user_pid = 1;
+
+uproc_t* uproc_current(void) {
+    return current_uproc;
+}
+
+bool uaccess_ok(uint64_t uaddr, size_t len) {
+    if (!current_uproc) return false;
+    if (len == 0) return true;
+    return vmspace_range_ok(current_uproc->vm, uaddr, len);
+}
+
+/*
+ * While a process runs, CR3 is its own, and its pages are mapped and present.
+ * The kernel can therefore dereference a user pointer directly -- but only
+ * after uaccess_ok() has confirmed the whole range really belongs to the
+ * process, otherwise a hostile pointer into the identity-mapped low 4 GB
+ * would read or scribble on the kernel itself.
+ */
+int uaccess_copy_from_user(void* dst, uint64_t usrc, size_t len) {
+    if (!uaccess_ok(usrc, len)) return -1;
+    memcpy(dst, (const void*)(uintptr_t)usrc, len);
+    return 0;
+}
+
+int uaccess_copy_to_user(uint64_t udst, const void* src, size_t len) {
+    if (!uaccess_ok(udst, len)) return -1;
+    memcpy((void*)(uintptr_t)udst, src, len);
+    return 0;
+}
+
+long uaccess_copy_string(char* dst, uint64_t usrc, size_t max) {
+    if (!dst || max == 0) return -1;
+    for (size_t i = 0; i < max; i++) {
+        if (!uaccess_ok(usrc + i, 1)) return -1;
+        char c = *(const char*)(uintptr_t)(usrc + i);
+        dst[i] = c;
+        if (c == '\0') return (long)i;
+    }
+    dst[max - 1] = '\0';
+    return -1;   /* not terminated within max */
+}
+
+void uproc_exit(int status) {
+    if (current_uproc) {
+        current_uproc->exit_code = status;
+        current_uproc->exited = true;
+    }
+    user_return((int64_t)status);
+    __builtin_unreachable();
+}
+
+void uproc_fault(const char* reason, uint64_t addr) {
+    printk(KERN_ERR "exec: killing '%s' (pid %d): %s at 0x%llx\n",
+           current_uproc ? current_uproc->name : "?",
+           current_uproc ? current_uproc->pid : -1,
+           reason ? reason : "fault",
+           (unsigned long long)addr);
+    uproc_exit(-1);
+}
+
+/*
+ * Build the System V entry stack: rsp points at argc, followed by the argv
+ * pointers, a NULL, and an empty environment. The program name string itself
+ * is copied to the very top of the stack.
+ */
+static int setup_user_stack(uproc_t* proc, uint64_t* rsp_out) {
+    uint64_t stack_bytes = USER_STACK_PAGES * VM_PAGE_SIZE;
+    uint64_t stack_low = USER_STACK_TOP - stack_bytes;
+
+    if (vmspace_alloc(proc->vm, stack_low, stack_bytes,
+                      VM_PROT_READ | VM_PROT_WRITE | VM_PROT_USER) != 0) {
+        return -1;
+    }
+
+    size_t name_len = strlen(proc->name) + 1;
+    uint64_t argv0 = (USER_STACK_TOP - name_len) & ~0xFULL;
+    if (vmspace_write(proc->vm, argv0, proc->name, name_len) != 0) return -1;
+
+    /* argc, argv[0], argv[1]=NULL, envp[0]=NULL */
+    uint64_t frame[4] = { 1, argv0, 0, 0 };
+    uint64_t rsp = (argv0 - sizeof(frame)) & ~0xFULL;
+    if (vmspace_write(proc->vm, rsp, frame, sizeof(frame)) != 0) return -1;
+
+    *rsp_out = rsp;
+    return 0;
+}
+
+int exec_user_image(const char* name, const void* image, size_t len) {
+    if (!image || len == 0) return -1;
+    if (current_uproc) {
+        printk(KERN_ERR "exec: nested exec is not supported yet\n");
+        return -1;
+    }
+
+    uproc_t* proc = (uproc_t*)kzalloc(sizeof(uproc_t));
+    if (!proc) return -1;
+
+    strncpy(proc->name, name ? name : "user", sizeof(proc->name) - 1);
+    proc->pid = next_user_pid++;
+
+    proc->vm = vmspace_create();
+    if (!proc->vm) {
+        printk(KERN_ERR "exec: out of memory building an address space\n");
+        kfree(proc);
+        return -1;
+    }
+
+    int err = elf_load(proc->vm, image, len, &proc->entry, &proc->brk_start);
+    if (err != ELF_OK) {
+        printk(KERN_ERR "exec: %s: %s\n", proc->name, elf_strerror(err));
+        vmspace_destroy(proc->vm);
+        kfree(proc);
+        return -1;
+    }
+    proc->brk = proc->brk_start;
+
+    uint64_t user_rsp = 0;
+    if (setup_user_stack(proc, &user_rsp) != 0) {
+        printk(KERN_ERR "exec: %s: cannot map a user stack\n", proc->name);
+        vmspace_destroy(proc->vm);
+        kfree(proc);
+        return -1;
+    }
+
+    /*
+     * Traps taken in ring 3 switch to TSS.rsp0, which must not be the stack
+     * user_enter() is standing on -- the CPU would push the trap frame over
+     * the frame we need to unwind to. Give the process its own kernel stack.
+     */
+    proc->kstack_size = USER_KSTACK_SIZE;
+    proc->kstack = (uint64_t)(uintptr_t)kmalloc(proc->kstack_size);
+    if (!proc->kstack) {
+        printk(KERN_ERR "exec: %s: cannot allocate a kernel stack\n", proc->name);
+        vmspace_destroy(proc->vm);
+        kfree(proc);
+        return -1;
+    }
+
+    printk(KERN_INFO "exec: %s entry=0x%llx brk=0x%llx rsp=0x%llx (%llu pages)\n",
+           proc->name, (unsigned long long)proc->entry,
+           (unsigned long long)proc->brk, (unsigned long long)user_rsp,
+           (unsigned long long)vmspace_resident_pages(proc->vm));
+
+    current_uproc = proc;
+    gdt_set_kernel_stack((proc->kstack + proc->kstack_size) & ~0xFULL);
+    vmspace_switch(proc->vm);
+
+    int status = (int)user_enter(proc->entry, user_rsp);
+
+    /* Back in ring 0 on the kernel's own stack: undo everything. */
+    vmspace_switch(NULL);
+    current_uproc = NULL;
+
+    printk(KERN_INFO "exec: %s exited with status %d\n", proc->name, status);
+
+    kfree((void*)(uintptr_t)proc->kstack);
+    vmspace_destroy(proc->vm);
+    kfree(proc);
+    return status;
+}
+
+/*
+ * The statically linked /sbin/init image, embedded in the kernel by
+ * scripts/mkblob.py so there is something to exec before any filesystem is
+ * mounted.
+ */
+extern const unsigned char subos_init_elf[];
+extern const size_t subos_init_elf_len;
+
+int exec_run_builtin_init(void) {
+    return exec_user_image("init", subos_init_elf, subos_init_elf_len);
+}
+
+#else  /* !__x86_64__ */
+
+uproc_t* uproc_current(void) { return NULL; }
+bool uaccess_ok(uint64_t uaddr, size_t len) { (void)uaddr; (void)len; return false; }
+int uaccess_copy_from_user(void* dst, uint64_t usrc, size_t len) {
+    (void)dst; (void)usrc; (void)len; return -1;
+}
+int uaccess_copy_to_user(uint64_t udst, const void* src, size_t len) {
+    (void)udst; (void)src; (void)len; return -1;
+}
+long uaccess_copy_string(char* dst, uint64_t usrc, size_t max) {
+    (void)dst; (void)usrc; (void)max; return -1;
+}
+
+void uproc_exit(int status) {
+    (void)status;
+    panic("uproc_exit() with no ring 3 support on this architecture");
+    __builtin_unreachable();
+}
+
+void uproc_fault(const char* reason, uint64_t addr) {
+    (void)reason; (void)addr;
+    panic("uproc_fault() with no ring 3 support on this architecture");
+    __builtin_unreachable();
+}
+
+int exec_user_image(const char* name, const void* image, size_t len) {
+    (void)image; (void)len;
+    printk(KERN_WARNING "exec: %s: ring 3 execution is only implemented on x86_64\n",
+           name ? name : "user");
+    return -1;
+}
+
+int exec_run_builtin_init(void) {
+    printk(KERN_WARNING "exec: no userland init on this architecture yet\n");
+    return -1;
+}
+
+#endif /* __x86_64__ */

kernel/main.c

@@ -92,6 +92,7 @@
 #include <userland/lazybox.h>
 #include <userland/sh.h>
 #include <userland/shell.h>
+#include <kernel/exec.h>
 
 static void subos_modular_core_boot(void) {
 #if defined(__x86_64__)
@@ -256,6 +257,10 @@ static void subos_modular_core_boot(void) {
     boot_logo_splash_end();
     fbcon_enable(true);
 
+    // Hand control to userland: /sbin/init is a separate static ELF that runs
+    // in ring 3 with its own page tables and talks back only through INT 0x80.
+    exec_run_builtin_init();
+
     // Launch Shell
     shell_run();
 

kernel/printk.c

@@ -49,6 +49,36 @@ static void dmesg_append(const char* str, size_t len) {
     }
 }
 
+/*
+ * Put raw bytes on every console printk uses.
+ *
+ * Kept here rather than at the call sites because the routing is not obvious:
+ * once the display adapter is in graphics mode the VGA text buffer is no
+ * longer scanned out, so the framebuffer console has to take over, and the
+ * serial port is a separate sink that has to be fed either way. Userland
+ * writes to stdout/stderr land here so they behave exactly like kernel output.
+ */
+void console_write(const char* data, size_t len) {
+    if (!data || len == 0) return;
+
+    if (fbcon_is_active()) {
+        fbcon_write(data, len);
+    } else {
+        tty_write(data, len);
+    }
+
+#if defined(__aarch64__) || defined(__arm__) || defined(__armv8i__)
+    extern void uart_pl011_putc(char c);
+    for (size_t i = 0; i < len; i++) {
+        uart_pl011_putc(data[i]);
+    }
+#else
+    for (size_t i = 0; i < len; i++) {
+        serial_write_char(data[i]);
+    }
+#endif
+}
+
 int vprintk(const char* fmt, va_list args) {
     char buffer[1024];
     int len = vsnprintf(buffer, sizeof(buffer), fmt, args);

kernel/syscall.c

@@ -1,36 +1,156 @@
 #include <kernel/syscall.h>
 #include <fs/vfs.h>
 #include <kernel/task.h>
+#include <kernel/exec.h>
 #include <kernel/signal.h>
 #include <kernel/printk.h>
+#include <drivers/tty.h>
+#include <mm/vmspace.h>
+
+#if defined(__x86_64__)
+#include <arch/x86_64/idt.h>
+#include <arch/x86_64/isr.h>
+
+/* Provided by arch/x86_64/cpu/isr_stubs.asm. */
+extern void isr_stub_syscall(void);
+
+#define SYSCALL_VECTOR 0x80
+
+/*
+ * Bring the trap frame into the SysV syscall shape. The kernel follows the
+ * Linux x86_64 convention -- number in RAX, arguments in RDI, RSI, RDX, R10,
+ * R8, R9 -- because RCX is clobbered by the CPU on a SYSCALL entry and R10
+ * stands in for it. Keeping the same order here means user code does not have
+ * to care which gate it came through.
+ */
+static void syscall_trap(registers_t* regs) {
+    regs->rax = (uint64_t)syscall_handler(regs->rax,
+                                          regs->rdi, regs->rsi, regs->rdx,
+                                          regs->r10, regs->r8, regs->r9);
+}
 
 void syscall_init(void) {
-    printk(KERN_INFO "SYSCALL: x86_64 Fast SYSCALL/SYSRET Dispatcher online\n");
+    /*
+     * DPL 3 so ring 3 may raise it, and an interrupt gate (0xEE) so IF is
+     * cleared on entry. The CPU takes the stack from TSS.rsp0, which the exec
+     * path points at a kernel stack owned by the running process.
+     */
+    idt_set_gate(SYSCALL_VECTOR, (void*)isr_stub_syscall, 0xEE);
+    isr_register_handler(SYSCALL_VECTOR, syscall_trap);
+    printk(KERN_INFO "SYSCALL: INT 0x%02X user gate installed (DPL 3)\n", SYSCALL_VECTOR);
+}
+#else
+void syscall_init(void) {
+    printk(KERN_INFO "SYSCALL: dispatcher online (no ring 3 gate on this architecture)\n");
+}
+#endif
+
+#define EFAULT_  (-14)
+#define ENOSYS_  (-38)
+#define EINVAL_  (-22)
+
+/*
+ * Validate a user-supplied buffer.
+ *
+ * When a syscall arrives from ring 3 the process page tables are still live,
+ * so a user pointer can be dereferenced directly -- which is exactly why the
+ * range has to be checked first. Without this, a program could pass 0x100000
+ * and have the kernel copy its own text out to the console.
+ *
+ * Calls made from kernel context (uproc_current() == NULL) are trusted.
+ */
+static bool user_buffer_ok(uint64_t ptr, size_t len) {
+    if (!uproc_current()) return true;
+    return uaccess_ok(ptr, len);
+}
+
+static int64_t sys_write(int fd, uint64_t buf, size_t count) {
+    if (count == 0) return 0;
+    if (!user_buffer_ok(buf, count)) return EFAULT_;
+
+    /* stdout and stderr go straight to the console: a process should be able
+     * to say something before any filesystem is mounted. console_write() is
+     * used rather than tty_write() so the bytes reach the serial port and the
+     * framebuffer console too, exactly like kernel output. */
+    if (fd == 1 || fd == 2) {
+        console_write((const char*)(uintptr_t)buf, count);
+        return (int64_t)count;
+    }
+    return (int64_t)vfs_write(fd, (const void*)(uintptr_t)buf, count);
+}
+
+static int64_t sys_read(int fd, uint64_t buf, size_t count) {
+    if (count == 0) return 0;
+    if (!user_buffer_ok(buf, count)) return EFAULT_;
+    return (int64_t)vfs_read(fd, (void*)(uintptr_t)buf, count);
+}
+
+/* Grow or query the program break. */
+static int64_t sys_brk(uint64_t addr) {
+    uproc_t* proc = uproc_current();
+    if (!proc) return EINVAL_;
+
+    if (addr == 0 || addr < proc->brk_start) return (int64_t)proc->brk;
+    if (addr > USER_STACK_TOP - (USER_STACK_PAGES * VM_PAGE_SIZE)) return (int64_t)proc->brk;
+
+    if (addr > proc->brk) {
+        if (vmspace_alloc(proc->vm, proc->brk, (size_t)(addr - proc->brk),
+                          VM_PROT_READ | VM_PROT_WRITE | VM_PROT_USER) != 0) {
+            return (int64_t)proc->brk;
+        }
+    }
+    proc->brk = addr;
+    return (int64_t)proc->brk;
+}
+
+static int64_t sys_open(uint64_t path, int flags) {
+    char kpath[256];
+    if (uproc_current()) {
+        if (uaccess_copy_string(kpath, path, sizeof(kpath)) < 0) return EFAULT_;
+        return (int64_t)vfs_open(kpath, flags);
+    }
+    return (int64_t)vfs_open((const char*)(uintptr_t)path, flags);
+}
+
+static int64_t sys_mkdir(uint64_t path, uint32_t mode) {
+    char kpath[256];
+    if (uproc_current()) {
+        if (uaccess_copy_string(kpath, path, sizeof(kpath)) < 0) return EFAULT_;
+        return (int64_t)vfs_mkdir(kpath, mode);
+    }
+    return (int64_t)vfs_mkdir((const char*)(uintptr_t)path, mode);
 }
 
 int64_t syscall_handler(uint64_t num, uint64_t a1, uint64_t a2, uint64_t a3, uint64_t a4, uint64_t a5, uint64_t a6) {
     (void)a4; (void)a5; (void)a6;
     switch (num) {
         case SYS_read:
-            return (int64_t)vfs_read((int)a1, (void*)a2, (size_t)a3);
+            return sys_read((int)a1, a2, (size_t)a3);
         case SYS_write:
-            return (int64_t)vfs_write((int)a1, (const void*)a2, (size_t)a3);
+            return sys_write((int)a1, a2, (size_t)a3);
         case SYS_open:
-            return (int64_t)vfs_open((const char*)a1, (int)a2);
+            return sys_open(a1, (int)a2);
         case SYS_close:
             return (int64_t)vfs_close((int)a1);
         case SYS_lseek:
             return (int64_t)vfs_lseek((int)a1, (off_t)a2, (int)a3);
-        case SYS_getpid:
-            return (int64_t)task_get_pid();
+        case SYS_brk:
+            return sys_brk(a1);
+        case SYS_getpid: {
+            uproc_t* proc = uproc_current();
+            return (int64_t)(proc ? proc->pid : task_get_pid());
+        }
         case SYS_kill:
             return (int64_t)signal_send((uint32_t)a1, (int)a2);
         case SYS_mkdir:
-            return (int64_t)vfs_mkdir((const char*)a1, (uint32_t)a2);
+            return sys_mkdir(a1, (uint32_t)a2);
         case SYS_exit:
+            /* A ring 3 process unwinds back into exec_user_image(); a kernel
+             * thread just tears itself down. */
+            if (uproc_current()) uproc_exit((int)a1);
             task_exit((int)a1);
             return 0;
         default:
-            return -1; // ENOSYS
+            return ENOSYS_;
     }
 }