Demand paging, the RTL8168H, links that come up late, and Ctrl+Alt+F1..F12

- Anonymous memory can be reserved without being backed: large mappings,
  MAP_NORESERVE and PROT_NONE are recorded and each page appears, zeroed,
  on first touch -- from trap() for the program, from uva2ka() for the
  kernel on its behalf. WebKit reserves 4 GB at start and touches a sliver;
  backing it all failed with ENOMEM and Epiphany aborted.
- r8169: the 8168G generation and later (the laptop's 8168H, XID 541) are
  taken from the firmware's out-of-band mode, get their PLL powered, the
  receive gate opened, and their PHY reached through the OCP window. The
  PHY's power-down bit is cleared; the old code kept it while restarting
  autonegotiation. Untested on the hardware so far.
- The network thread follows each device's link into lwIP. The link was
  read once at attach, 0.02 s into boot; real autonegotiation takes
  seconds, so on hardware the interface stayed down for good.
- Twelve terminals, switched with Ctrl+Alt+F1..F12 by default: the keys X
  uses, so the console and the desktop agree. AltGr+F-key is gone from
  the defaults (chvt -c altgr+F brings it back).
- SO_PASSCRED on Unix sockets, with SCM_CREDENTIALS delivered by recvmsg.
  WebKit sets it on its IPC sockets and aborted when refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

kernel/arch/x86_64/trap.c

@@ -160,6 +160,11 @@ trap(struct trapframe *tf)
     }
 
   unexpected:
+    // A user page fault on anonymous memory that is reserved but not backed
+    // yet: the page is made and the instruction runs again. See vm_fault().
+    if(tf->trapno == T_PGFLT && myproc() && (tf->cs&3) == DPL_USER &&
+       !(tf->err & 1) && vm_fault(rcr2()) == 0)
+      break;
     if(myproc() == 0 || (tf->cs&3) == 0){
       // A kernel-mode trap ends in panic() a dozen lines down, so the console
       // can be put into its panic mode *now* -- and it has to be, because the