feat(exec): Run userland in ring 3 with an ELF64 loader and per-process page tables

SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.

Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
  rest empty, so userland is given its own PML4 slot (512 GiB) rather than
  holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
  entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
  unmapped pointer; lifting that needs a recursive map or a higher-half
  direct map, which is noted in the file.

ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
  header against both the image and the user address range, and lays PT_LOAD
  segments into an address space. Frames arrive zeroed, so .bss is covered.

Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
  user_return() unwinds back to it when the process exits, so exec looks like
  a call that blocks until the program finishes.

Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
  The process gets its own kernel stack for the trap, because TSS.rsp0 must
  not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
  still live during a syscall, so without that check a program could pass a
  kernel address and have write(2) dump kernel text to the console. The new
  /sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
  reuses printk's routing so output reaches serial and the framebuffer
  console rather than only the VGA text buffer.

Faults
- A ring 3 exception now kills that process and reports CR2 instead of
  panicking the machine.

Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
  base and embedded in the kernel image by scripts/mkblob.py. It reports its
  pid, verifies .bss was zeroed and .data is writable, checks the two pointer
  rejections, and exits.

aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.

Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

userland/init/init.c

@@ -0,0 +1,130 @@
+/*
+ * SUB-OS /sbin/init -- the first program that runs outside the kernel.
+ *
+ * Built freestanding and static: no libc, no startup files, nothing shared
+ * with the kernel image. Every service it uses arrives through INT 0x80, so
+ * running it end to end proves the ELF loader, the user page tables, the ring
+ * transition and the syscall gate all agree with each other.
+ */
+
+typedef unsigned long size_t;
+typedef long ssize_t;
+
+#define SYS_read    0
+#define SYS_write   1
+#define SYS_getpid  39
+#define SYS_exit    60
+#define SYS_brk     12
+
+#define STDOUT 1
+
+static long syscall3(long nr, long a1, long a2, long a3) {
+    long ret;
+    __asm__ volatile("int $0x80"
+                     : "=a"(ret)
+                     : "a"(nr), "D"(a1), "S"(a2), "d"(a3)
+                     : "memory", "rcx", "r11");
+    return ret;
+}
+
+static long syscall1(long nr, long a1) {
+    return syscall3(nr, a1, 0, 0);
+}
+
+static size_t ustrlen(const char* s) {
+    size_t n = 0;
+    while (s[n]) n++;
+    return n;
+}
+
+static void write_str(const char* s) {
+    syscall3(SYS_write, STDOUT, (long)s, (long)ustrlen(s));
+}
+
+static void write_dec(long value) {
+    char buf[24];
+    int i = (int)sizeof(buf);
+    int negative = 0;
+
+    if (value < 0) { negative = 1; value = -value; }
+    buf[--i] = '\0';
+    do {
+        buf[--i] = (char)('0' + (value % 10));
+        value /= 10;
+    } while (value && i > 1);
+    if (negative && i > 0) buf[--i] = '-';
+
+    write_str(&buf[i]);
+}
+
+static void write_hex(unsigned long value) {
+    static const char digits[] = "0123456789abcdef";
+    char buf[19];
+    int i = (int)sizeof(buf);
+
+    buf[--i] = '\0';
+    do {
+        buf[--i] = digits[value & 0xF];
+        value >>= 4;
+    } while (value && i > 2);
+    buf[--i] = 'x';
+    buf[--i] = '0';
+
+    write_str(&buf[i]);
+}
+
+/* Lives in .data, so a writable PT_LOAD segment has to have been mapped. */
+static char greeting[] = "SUB-OS userland is alive.\n";
+
+/* Lives in .bss, so the loader has to have zero-filled the tail of a segment.
+ * volatile keeps the compiler from folding the check away: without it gcc
+ * proves the array is never written and drops it, taking .bss with it. */
+static volatile char zero_probe[64];
+
+void _start(void) {
+    write_str("\n");
+    write_str("=== /sbin/init (ring 3) ===\n");
+    write_str(greeting);
+
+    write_str("  pid            : ");
+    write_dec(syscall1(SYS_getpid, 0));
+    write_str("\n");
+
+    write_str("  code address   : ");
+    write_hex((unsigned long)(void*)_start);
+    write_str("\n");
+
+    write_str("  stack address  : ");
+    unsigned long here;
+    __asm__ volatile("mov %%rsp, %0" : "=r"(here));
+    write_hex(here);
+    write_str("\n");
+
+    /* .bss must have arrived zeroed. */
+    int bss_clean = 1;
+    for (unsigned i = 0; i < sizeof(zero_probe); i++) {
+        if (zero_probe[i] != 0) bss_clean = 0;
+    }
+    write_str("  .bss zeroed    : ");
+    write_str(bss_clean ? "yes\n" : "NO\n");
+
+    /* .data must be writable. */
+    greeting[0] = 'S';
+    write_str("  .data writable : yes\n");
+
+    /* An unmapped user address must be rejected rather than served. */
+    long bad = syscall3(SYS_write, STDOUT, (long)0x7fffffffffffUL, 8);
+    write_str("  bad pointer    : ");
+    write_str(bad < 0 ? "rejected\n" : "ACCEPTED (bug)\n");
+
+    /* A kernel address must be rejected too, even though it is mapped. */
+    long kern = syscall3(SYS_write, STDOUT, (long)0x100000UL, 8);
+    write_str("  kernel pointer : ");
+    write_str(kern < 0 ? "rejected\n" : "ACCEPTED (bug)\n");
+
+    write_str("=== init exiting with status 0 ===\n\n");
+    syscall1(SYS_exit, 0);
+
+    /* SYS_exit does not return; spin defensively if it ever did. */
+    for (;;) { }
+}

userland/init/user.ld

@@ -0,0 +1,24 @@
+/*
+ * Userland link map.
+ *
+ * Programs are placed inside the PML4 slot the kernel reserves for user
+ * mappings (512 GiB), well clear of the identity-mapped low 4 GB where the
+ * kernel itself lives. Keep this base in sync with USER_LOAD_BASE in
+ * include/mm/vmspace.h.
+ */
+ENTRY(_start)
+
+SECTIONS
+{
+    . = 0x8000400000;
+
+    .text : ALIGN(4K) { *(.text*) }
+    .rodata : ALIGN(4K) { *(.rodata*) }
+    .data : ALIGN(4K) { *(.data*) }
+    .bss : ALIGN(4K) {
+        *(COMMON)
+        *(.bss*)
+    }
+
+    /DISCARD/ : { *(.comment) *(.note*) *(.eh_frame*) }
+}