Userspace Entry

Define a minimal process abstraction. Why it matters: Processes need their own page tables, file descriptors, and lifecycle state — separate from the kernel task that executes them. Focus on `Process` and `ProcessState` in `kernel/src/process/mod.rs` while you trace the snippet.

/// A minimal userspace process descriptor.
pub struct Process {
    /// Virtual address of the process entry point.
    pub entry: u64,
    /// Virtual address of the process stack top.
    pub stack_top: u64,
}

View on GitHub

Build a user address space. Why it matters: Userspace code must execute in its own virtual address space with code, stack, and kernel-protected mappings to enforce isolation. Focus on `copy_to_user` in `kernel/src/mm/user_space.rs` while you trace the snippet.

/// Copy `src` bytes into the user code region at `virt_base`.
///
/// The region must already be mapped (e.g. via `map_user_pages`).
/// The bounds check is sized to the **code** region (`USER_CODE_PAGES * 4096`);
/// do not use this helper to write to the stack or any other user region.
pub fn copy_to_user(virt_base: u64, src: &[u8]) -> Result<(), &'static str> {
    let max_bytes = (USER_CODE_PAGES * 4096) as usize;
    if src.len() > max_bytes {
        return Err("copy_to_user: src exceeds mapped user code region");
    }
    // Safety: caller guarantees virt_base is mapped and we've checked the length.
    let dst = unsafe { core::slice::from_raw_parts_mut(virt_base as *mut u8, src.len()) };
    dst.copy_from_slice(src);
    Ok(())
}

View on GitHub

Implement the transition into ring 3. Why it matters: The ring transition is the security boundary — it drops privilege from ring 0 to ring 3 using iretq with the correct segment selectors. Focus on `enter_userspace` and `iretq` in `kernel/src/arch/x86_64/mod.rs` while you trace the snippet.

/// Transfer execution to ring 3 (userspace).
///
/// Uses `iretq` to atomically switch to user code segment, user stack, and
/// the given entry point with interrupts enabled (RFLAGS.IF = 1).
///
/// # Safety
///
/// * `entry` must be a valid, mapped, executable userspace virtual address.
/// * `user_stack_top` must be a valid, mapped, writable userspace stack
///   address (highest address; stack grows downward).
/// * Must be called after `init()` so that GDT user segments are loaded.
pub unsafe fn enter_userspace(entry: u64, user_stack_top: u64) -> ! {
    use core::arch::asm;
    // Push the five values that `iretq` pops in order:
    //   SS, RSP, RFLAGS, CS, RIP
    // RFLAGS: bit 9 (IF) set → interrupts enabled in userspace.
    asm!(
        "push {ss}",
        "push {rsp}",
        "push {rflags}",
        "push {cs}",
        "push {rip}",
        "iretq",
        ss     = in(reg) u64::from(gdt::user_data_selector().0),

View on GitHub