How does the init process switch from kernel to user?

Article Title: How the init process switches from the kernel state to the user state. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Author: chstar
========================================================== ======
Everyone knows how to create a new process.
Use sys_fork and then call sys_execve
The first user-state process after the system starts (core state) is init.
This involves the transfer from the inner layer (high privilege level) to the outer layer (low privilege level.
In general, the kernel does not call user-Layer Code. to implement this reverse transfer, the general approach is to go to the core stack of the user process (tss-> esp0) the SS, ESP, EFLAGS, CS, and EIP pushed into the user state are disguised as user processes entering the core state through the trap gate, and then return the user state through iret.
In linux 2.2.14, how does one implement the user-state process init?
First in kernel_thread (init ...) function, use the system to call sys_clone fork to generate a kernel-level process (in this case, allocate the core stack to the process <-esp0), then call the init function, the init function will start several more kernel_thread, then/sbin/init will be loaded (called through execve)
In sys_execve, the kernel state must be transferred to the user state.
The general process is sys_execve --> do_execve --> load_elf_binary ()
--> Do_load_elf_binary () --> do_mmap ()
Start_thread (reg, newip, newsp) (processor. h)
It is important to pay attention to do_mmap () and start_thread ().
Do_mmap maps the virtual space from the file to the memory.
Start_thread is to fill in the xss, esp, xcs, and eip of the process User state in the corresponding position in the process core stack.
Finally, the process returns from ret_from_sys_call, and the iret command pops out xcs from the core stack. the eip completes the transfer of privileges and commands, and pops out xss and esp to complete stack switching.
I have just read the code above. if there is something wrong with it, I hope you can point it out.