feat(exec): Run userland in ring 3 with an ELF64 loader and per-process page tables

SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.

Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
  rest empty, so userland is given its own PML4 slot (512 GiB) rather than
  holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
  entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
  unmapped pointer; lifting that needs a recursive map or a higher-half
  direct map, which is noted in the file.

ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
  header against both the image and the user address range, and lays PT_LOAD
  segments into an address space. Frames arrive zeroed, so .bss is covered.

Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
  user_return() unwinds back to it when the process exits, so exec looks like
  a call that blocks until the program finishes.

Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
  The process gets its own kernel stack for the trap, because TSS.rsp0 must
  not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
  still live during a syscall, so without that check a program could pass a
  kernel address and have write(2) dump kernel text to the console. The new
  /sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
  reuses printk's routing so output reaches serial and the framebuffer
  console rather than only the VGA text buffer.

Faults
- A ring 3 exception now kills that process and reports CR2 instead of
  panicking the machine.

Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
  base and embedded in the kernel image by scripts/mkblob.py. It reports its
  pid, verifies .bss was zeroed and .data is writable, checks the two pointer
  rejections, and exits.

aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.

Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

kernel/syscall.c

@@ -1,36 +1,156 @@
 #include <kernel/syscall.h>
 #include <fs/vfs.h>
 #include <kernel/task.h>
+#include <kernel/exec.h>
 #include <kernel/signal.h>
 #include <kernel/printk.h>
+#include <drivers/tty.h>
+#include <mm/vmspace.h>
+
+#if defined(__x86_64__)
+#include <arch/x86_64/idt.h>
+#include <arch/x86_64/isr.h>
+
+/* Provided by arch/x86_64/cpu/isr_stubs.asm. */
+extern void isr_stub_syscall(void);
+
+#define SYSCALL_VECTOR 0x80
+
+/*
+ * Bring the trap frame into the SysV syscall shape. The kernel follows the
+ * Linux x86_64 convention -- number in RAX, arguments in RDI, RSI, RDX, R10,
+ * R8, R9 -- because RCX is clobbered by the CPU on a SYSCALL entry and R10
+ * stands in for it. Keeping the same order here means user code does not have
+ * to care which gate it came through.
+ */
+static void syscall_trap(registers_t* regs) {
+    regs->rax = (uint64_t)syscall_handler(regs->rax,
+                                          regs->rdi, regs->rsi, regs->rdx,
+                                          regs->r10, regs->r8, regs->r9);
+}
 
 void syscall_init(void) {
-    printk(KERN_INFO "SYSCALL: x86_64 Fast SYSCALL/SYSRET Dispatcher online\n");
+    /*
+     * DPL 3 so ring 3 may raise it, and an interrupt gate (0xEE) so IF is
+     * cleared on entry. The CPU takes the stack from TSS.rsp0, which the exec
+     * path points at a kernel stack owned by the running process.
+     */
+    idt_set_gate(SYSCALL_VECTOR, (void*)isr_stub_syscall, 0xEE);
+    isr_register_handler(SYSCALL_VECTOR, syscall_trap);
+    printk(KERN_INFO "SYSCALL: INT 0x%02X user gate installed (DPL 3)\n", SYSCALL_VECTOR);
+}
+#else
+void syscall_init(void) {
+    printk(KERN_INFO "SYSCALL: dispatcher online (no ring 3 gate on this architecture)\n");
+}
+#endif
+
+#define EFAULT_  (-14)
+#define ENOSYS_  (-38)
+#define EINVAL_  (-22)
+
+/*
+ * Validate a user-supplied buffer.
+ *
+ * When a syscall arrives from ring 3 the process page tables are still live,
+ * so a user pointer can be dereferenced directly -- which is exactly why the
+ * range has to be checked first. Without this, a program could pass 0x100000
+ * and have the kernel copy its own text out to the console.
+ *
+ * Calls made from kernel context (uproc_current() == NULL) are trusted.
+ */
+static bool user_buffer_ok(uint64_t ptr, size_t len) {
+    if (!uproc_current()) return true;
+    return uaccess_ok(ptr, len);
+}
+
+static int64_t sys_write(int fd, uint64_t buf, size_t count) {
+    if (count == 0) return 0;
+    if (!user_buffer_ok(buf, count)) return EFAULT_;
+
+    /* stdout and stderr go straight to the console: a process should be able
+     * to say something before any filesystem is mounted. console_write() is
+     * used rather than tty_write() so the bytes reach the serial port and the
+     * framebuffer console too, exactly like kernel output. */
+    if (fd == 1 || fd == 2) {
+        console_write((const char*)(uintptr_t)buf, count);
+        return (int64_t)count;
+    }
+    return (int64_t)vfs_write(fd, (const void*)(uintptr_t)buf, count);
+}
+
+static int64_t sys_read(int fd, uint64_t buf, size_t count) {
+    if (count == 0) return 0;
+    if (!user_buffer_ok(buf, count)) return EFAULT_;
+    return (int64_t)vfs_read(fd, (void*)(uintptr_t)buf, count);
+}
+
+/* Grow or query the program break. */
+static int64_t sys_brk(uint64_t addr) {
+    uproc_t* proc = uproc_current();
+    if (!proc) return EINVAL_;
+
+    if (addr == 0 || addr < proc->brk_start) return (int64_t)proc->brk;
+    if (addr > USER_STACK_TOP - (USER_STACK_PAGES * VM_PAGE_SIZE)) return (int64_t)proc->brk;
+
+    if (addr > proc->brk) {
+        if (vmspace_alloc(proc->vm, proc->brk, (size_t)(addr - proc->brk),
+                          VM_PROT_READ | VM_PROT_WRITE | VM_PROT_USER) != 0) {
+            return (int64_t)proc->brk;
+        }
+    }
+    proc->brk = addr;
+    return (int64_t)proc->brk;
+}
+
+static int64_t sys_open(uint64_t path, int flags) {
+    char kpath[256];
+    if (uproc_current()) {
+        if (uaccess_copy_string(kpath, path, sizeof(kpath)) < 0) return EFAULT_;
+        return (int64_t)vfs_open(kpath, flags);
+    }
+    return (int64_t)vfs_open((const char*)(uintptr_t)path, flags);
+}
+
+static int64_t sys_mkdir(uint64_t path, uint32_t mode) {
+    char kpath[256];
+    if (uproc_current()) {
+        if (uaccess_copy_string(kpath, path, sizeof(kpath)) < 0) return EFAULT_;
+        return (int64_t)vfs_mkdir(kpath, mode);
+    }
+    return (int64_t)vfs_mkdir((const char*)(uintptr_t)path, mode);
 }
 
 int64_t syscall_handler(uint64_t num, uint64_t a1, uint64_t a2, uint64_t a3, uint64_t a4, uint64_t a5, uint64_t a6) {
     (void)a4; (void)a5; (void)a6;
     switch (num) {
         case SYS_read:
-            return (int64_t)vfs_read((int)a1, (void*)a2, (size_t)a3);
+            return sys_read((int)a1, a2, (size_t)a3);
         case SYS_write:
-            return (int64_t)vfs_write((int)a1, (const void*)a2, (size_t)a3);
+            return sys_write((int)a1, a2, (size_t)a3);
         case SYS_open:
-            return (int64_t)vfs_open((const char*)a1, (int)a2);
+            return sys_open(a1, (int)a2);
         case SYS_close:
             return (int64_t)vfs_close((int)a1);
         case SYS_lseek:
             return (int64_t)vfs_lseek((int)a1, (off_t)a2, (int)a3);
-        case SYS_getpid:
-            return (int64_t)task_get_pid();
+        case SYS_brk:
+            return sys_brk(a1);
+        case SYS_getpid: {
+            uproc_t* proc = uproc_current();
+            return (int64_t)(proc ? proc->pid : task_get_pid());
+        }
         case SYS_kill:
             return (int64_t)signal_send((uint32_t)a1, (int)a2);
         case SYS_mkdir:
-            return (int64_t)vfs_mkdir((const char*)a1, (uint32_t)a2);
+            return sys_mkdir(a1, (uint32_t)a2);
         case SYS_exit:
+            /* A ring 3 process unwinds back into exec_user_image(); a kernel
+             * thread just tears itself down. */
+            if (uproc_current()) uproc_exit((int)a1);
             task_exit((int)a1);
             return 0;
         default:
-            return -1; // ENOSYS
+            return ENOSYS_;
     }
 }