userspace: switch PID 1 to busybox init

[sysheap]

Summary

• Replaces Solaya's Rust init binary with busybox init as PID 1, driven by /etc/inittab from the buildroot overlay; busybox runs /etc/init.d/rcS, waits on /bin/dhcpd, and respawns /bin/dash -i on the serial console.
• Adds the kernel primitives busybox expects on boot/shutdown: shebang exec (4 layers), rt_sigtimedwait, reboot(2) (with LINUX_REBOOT_* now bindgen'd from linux/reboot.h), a sync(2) stub, and open("/dev/console") → FileDescriptor::Tty (via a new CharDevice::is_tty trait method, replacing an Arc-identity static).
• Converts socket(2)'s unsupported-domain/type panics into EAFNOSUPPORT / EPROTONOSUPPORT.
• Deletes the Rust init binary, re-points load_init_bytes to /sbin/init first, and re-syncs QEMU boot on the dash shell prompt instead of the old Rust-init banner lines.

Review follow-ups included in the same branch: a shebang fast-path (peek SHEBANG_MAX_LINE before pulling a multi-MiB ELF into memory), loader::load_elf errors now propagate as ENOEXEC to userspace, PendingSignals::first_unblocked/first_in collapsed into one first_matching, and the rt_sigtimedwait wake path now uses a sigtimedwait_mask: Option<u64> armed/disarmed by the future instead of a bespoke signal_waker: Option<Waker> slot on Thread.

Test plan

• cmake --build build --target clippy clean.
• cmake --build build --target test-system — all 71 system tests pass, including shutdown (busybox halt → reboot(2) → HALT) and the signal/job-control suites.
• Spot-check an interactive boot (just run): busybox inittab runs dhcpd, dash comes up on the console, halt cleanly exits QEMU.

🤖 Generated with Claude Code

[claude]

AI Architectural Review

TL;DR: Good direction — swapping the Rust PID 1 for busybox init, wiring up the syscalls busybox actually exercises (rt_sigtimedwait, reboot, sync, 4-layer shebang) and turning bad socket(2) inputs into errnos instead of panics are all net wins for Linux-compat; the main smells are policy nits (a single-caller helper, duplicated path-composition) and a couple of stop-gaps (/dev/console implicit-ctty, unchecked reboot authority) that should be tracked so they don't calcify.

Must-fix (correctness / safety / policy violations)

none

Consider (architecture / duplication / design smell)

• read_full_node is a helper with a single call site — crates/kernel/src/syscalls/exec_ops.rs:273 (invoked only at :228). CLAUDE.md explicitly bans single-caller helpers; the 64 MiB cap + read + truncate is 5 lines and reads fine inline.
• resolve_against_cwd reinvents crates/kernel/src/syscalls/helpers.rs:12 (compose_abs) — same absolute/ends-with-//else branching at crates/kernel/src/syscalls/exec_ops.rs:260. compose_abs additionally canonicalizes ../. segments, which is arguably more correct for shebang-resolved paths. Reuse the existing helper rather than carrying a parallel copy.
• Implicit-ctty stop-gap at crates/kernel/src/syscalls/fs_ops.rs:67-77 unconditionally hijacks console_tty().fg_pgid on every openat("/dev/console"), not just the session leader's first open — any later opener silently steals the foreground pgid from the shell. The comment points at Unprivileged foreground-group hijack via open(/dev/console) #262 but the failure mode (a rogue userspace program breaking dash's job control with a single open) is wide open until then; at minimum gate it on "fg_pgid unset or matches caller's session" so it degrades to a no-op after dash claims the console.
• FileDescriptor::Tty(console_tty().clone()) at crates/kernel/src/syscalls/fs_ops.rs:77 ignores the node/dev that triggered is_tty — the CharDevice::is_tty trait method suggests a generic TTY-wrapping story, but the concrete wiring assumes exactly one global console. Either drop the trait method and special-case the console node in devfs, or thread the actual Arc<dyn CharDevice> through so a second TTY device doesn't silently alias to the console.
• do_rt_sigtimedwait rejects every finite non-zero timeout with EINVAL (crates/kernel/src/syscalls/signal_ops.rs:171). That's fine for busybox-init's usage today, but it's a ticking Linux-compat trap — a posted finding/issue would keep it from being forgotten once something actually passes a 100 ms timeout.
• parse_shebang (crates/kernel/src/syscalls/exec_ops.rs:173) is pure byte-slice logic with non-trivial edge cases (empty line, all-whitespace, no-newline-in-257-bytes, optional-arg trimming). CLAUDE.md calls these out as prime Kani targets — worth a proof that it never panics on arbitrary byte input and that layer count stays ≤ MAX_SHEBANG_DEPTH.
• do_reboot has no authority check (crates/kernel/src/syscalls/process_ops.rs:221). The TODO: CAP_SYS_BOOT comment is honest, but until Solaya has credentials any userspace process (prog1, a buggy dhcpd) can halt the kernel — flag this as a tracked issue so it doesn't disappear into the diff.

Noted (weird but I'm not sure — maintainer eyeball please)

• parse_shebang returns Errno::ENOEXEC when the first line lacks a \n within SHEBANG_MAX_LINE (crates/kernel/src/syscalls/exec_ops.rs:180). Linux's BINPRM_BUF_SIZE path truncates at the buffer and parses what it has — ours is stricter. Almost certainly irrelevant for real scripts, but flagging because it's a silent divergence from the reference implementation we're targeting.
• info!("No more processes to schedule, shutting down system") in do_reboot (crates/kernel/src/syscalls/process_ops.rs:236) is factually wrong for a deliberate reboot(HALT) — there may still be other processes. The string is load-bearing for the shutdown system test, so swapping it requires a test update; noting in case the message is supposed to mean something specific and should be kept accurate.
• No dedicated system test exercises the multi-layer shebang path — rcS (configs/overlay/etc/init.d/rcS, a single-layer #!/bin/dash) exercises depth-1 via boot, but depth-2+ and the ELOOP-on-4-layers edge go untested. Given this is the first implementation, a tiny system-test with a chain of three shebangs would lock in the argv-assembly semantics.

Skipped

Style, clippy-level lints, naming, docstrings on private items, commit-message conventions — just ci enforces these and the maintainer has them out of scope.