nx_nishios_userspace.nx

nx_nishios_userspace.nx -- NishiOS rung-9: BARE-METAL USERSPACE (the kernel<->user privilege boundary). The essence of "userspace running ON the kernel" (not under Linux): a user program runs at ring 3 and can only touch privileged resources THROUGH the kernel via syscalls. The emu gains a privilege level (cpl), a syscall TRAP (user 0F05 -> save return, cpl=0, vector to the kernel handler via LSTAR), sysret (0F07 -> cpl=3, back to user), and a WRITE-PRIVILEGE CHECK (a store to the kernel region at cpl!=0 FAULTS). The user program: (1) tries to write the kernel buffer DIRECTLY -> faults/blocked; (2) asks the kernel to write it via syscall -> the kernel does it on the user's behalf. KAT: the direct privileged write is BLOCKED (fault raised, value never lands); the syscall write SUCCEEDS (kernel wrote it); only the kernel-mediated value is in the buffer; clean exit. => the privilege boundary is real: userspace reaches the hardware only through the kernel. HONEST SCOPE: a minimal ring0/ring3 + one syscall (kwrite); full process model (multiple tasks, memory isolation per process, ELF loading) is the continuation. No hw writes (Rule 26). expect_exit: 0 tier: ORIGINAL