kernel: processes have an environment now, and zsh is the shell

Porting zsh found four defects in the kernel and one in the filesystem. None
of them were about zsh; all of them had been there the whole time.

**exec threw the environment away.** kernel/fs/exec.c wrote a single zero for
envp with the comment "(no environment)" -- not yet, but ever, for every
process. musl has been passing a perfectly good envp to execve (Linux 59, which
SchOS answers) and it was never read. So $TERM was unset, $PATH was whatever
each program invented, and a variable exported in a shell did not survive the
exec meant to carry it. exec() takes an envp, sys_exec reads argument three,
and schinit manifests grew an Environment key. The userland two-argument
exec(path, argv) stays as a wrapper that passes null explicitly -- the raw stub
is execve now, so a short caller cannot leave %rdx holding a stray pointer.

**Which overflowed the kernel stack.** Three pointer arrays, ~1.8 KB, on a
4096-byte stack, under exec -> loaduvm -> readi -> SchFS -> btree. Pid 1 went
down on the first exec. The canary caught it and named the process, which is
what it is for. They live in one kalloc'd page now.

**waitpid returned a bare -1** for both "no children" and "interrupted". musl
reads [-4095,-1] as -errno, so userspace saw EPERM; zsh printed "wait failed:
operation not permitted" and abandoned the rest of /etc/zsh/zshrc. -ECHILD and
-EINTR now. Third time a bare -1 has cost real time -- on a system with no
permission model, EPERM should be read as "a syscall returned -1".

**NVMA was 64.** musl's allocator takes a mapping per size class and does not
release them eagerly, so compinit ran out of slots and got -1, which is EPERM,
which malloc turns into NULL, which zsh reports as "fatal error: out of memory"
-- on a machine with 1000 MB free. 256 slots, and -ENOMEM.

**And a small write to SchFS costs 58 ms.** 200 writes to one open file take
11.75 s; the same to /dev/null take 0.14 s. That is the design stated at the
top of kmount.c -- one transaction group per operation, and a commit is two
flushes and an uberblock -- not a bug. But compdump writes its digest with
thousands of separate prints, so it takes minutes and looks like a hang.
compinit -D, which skips the dump, finishes in 3.6 s. This one is a decision
rather than a fix, so it is written up and left: /etc/zsh/zshrc keeps compinit
switched off and explains exactly why, with the measurements.

zsh runs as /bin/zsh and is the console shell. ZLE works -- arrow keys recall
history through terminfo, $COLUMNS reads the real 160 because TIOCGWINSZ was
fixed, colour and prompt expansion work, startup is 0.14 s. mksh keeps /bin/sh,
so schinit's no-jobs fallback is a different program from the one that could
have failed.

Also fixed while here: AT_CLKTCK was the literal 100 and is USER_HZ; the
extract rule in four ports could move a source tree inside itself when make
re-ran it, which is how zsh's configure came to write modfile=zsh-5.9/... into
config.modules and fail three steps later.

schfs-check passes. Full writeup in docs/history/kernel.md section 14.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/fs/exec.c

@@ -18,20 +18,39 @@
 extern int linux_syscall_map[];
 extern int linux_syscall_map_size;
 
+// envp may be null, which means "no environment" -- the same thing this
+// function used to do unconditionally.
 int
-exec(char *path, char **argv)
+exec(char *path, char **argv, char **envp)
 {
   uint64 _t0 = rdtsc();
   fsstat.exec_calls++;
   char *s, *last;
   int i, off;
-  uint64 argc, sz, sp, ustack[MAXARG+1];
+  uint64 argc, envc, sz, sp;
   struct elfhdr elf;
   struct inode *ip;
   struct proghdr ph;
   pml4e_t *pgdir, *oldpgdir;
-  uint64 stack_slots[MAXARG + 32];
   int slot;
+
+  // The three pointer arrays live on the heap, not on the kernel stack.
+  //
+  // Together they are about 1.8 KB, and KSTACKSIZE is 4096 -- with the call
+  // chain under this function running exec -> loaduvm -> readi -> SchFS ->
+  // btree, there is not 1.8 KB to spare. Putting them here overflowed the
+  // stack on the first exec after the environment was added, and the canary
+  // in param.h caught it on pid 1 before it could corrupt anything.
+  //
+  // One page holds all three with room over.
+  uint64 *scratch = (uint64*)kalloc();
+  if(!scratch)
+    return -1;
+  uint64 *ustack      = scratch;                      /* MAXARG+1  */
+  uint64 *estack      = ustack + MAXARG + 1;          /* MAXENV+1  */
+  uint64 *stack_slots = estack + MAXENV + 1;          /* the rest   */
+  _Static_assert((MAXARG + 1 + MAXENV + 1 + MAXARG + MAXENV + 32) * 8 <= 4096,
+                 "exec scratch does not fit in one page");
   uint64 max_sz = 0;
   uint64 rand_va = 0;
 
@@ -97,6 +116,19 @@ exec(char *path, char **argv)
     ustack[argc] = sp;
   }
 
+  // The environment, copied the same way and for the same reason: these
+  // strings live in the *old* address space, which is still mapped, and will
+  // not be once the new pgdir is installed.
+  for(envc = 0; envp && envp[envc]; envc++) {
+    if(envc >= MAXENV)
+      goto bad;
+    sp -= strlen(envp[envc]) + 1;
+    sp &= ~7;
+    if(copyout(pgdir, sp, envp[envc], strlen(envp[envc]) + 1) < 0)
+      goto bad;
+    estack[envc] = sp;
+  }
+
   // Push 16 pseudo-random bytes for AT_RANDOM.
   {
     uint8 randbuf[16];
@@ -117,13 +149,20 @@ exec(char *path, char **argv)
   }
   stack_slots[slot++] = 0;    // end of argv
 
-  stack_slots[slot++] = 0;    // end of envp (no environment)
+  // The environment used to be a single zero here, with the comment "(no
+  // environment)". Nothing on SchOS had one: not a shell, not a musl program
+  // that had just called execve with a perfectly good envp, not anything. So
+  // $TERM was unset, $PATH was whatever each program invented, and a variable
+  // exported in a shell did not survive the exec that was supposed to carry it.
+  for(i = 0; i < envc; i++)
+    stack_slots[slot++] = estack[i];
+  stack_slots[slot++] = 0;    // end of envp
 
   // Auxiliary vector — musl reads these for page size, clock, etc.
   stack_slots[slot++] = 6;    // AT_PAGESZ
   stack_slots[slot++] = 4096;
   stack_slots[slot++] = 17;   // AT_CLKTCK
-  stack_slots[slot++] = 100;
+  stack_slots[slot++] = USER_HZ;   // what times() is scaled to, not a literal
   stack_slots[slot++] = 23;   // AT_SECURE = 0 (not setuid)
   stack_slots[slot++] = 0;
   stack_slots[slot++] = 11;   // AT_UID
@@ -232,10 +271,12 @@ exec(char *path, char **argv)
 
   switchuvm(myproc());
   freevm(oldpgdir);
+  kfree((char*)scratch);
   fsstat.exec_cycles += rdtsc() - _t0;
   return 0;
 
  bad:
+  kfree((char*)scratch);
   if(pgdir)
     freevm(pgdir);
   if(ip){

kernel/proc/proc.c

@@ -383,9 +383,20 @@ waitpid(int pid, int *status, int options)
       }
     }
 
-    if(!havekids || myproc()->killed){
+    // Two different failures, and they used to share one bare -1.
+    //
+    // musl reads a return in [-4095, -1] as -errno, so -1 arrived in
+    // userspace as EPERM: "operation not permitted". zsh's compinit calls
+    // wait, got that, printed "wait failed: operation not permitted", and
+    // abandoned the rest of /etc/zsh/zshrc -- which looked like a broken
+    // config file rather than a wait() that could not say what went wrong.
+    if(!havekids){
       release(&ptable.lock);
-      return -1;
+      return -ECHILD;          // nothing to wait for, which is not an error
+    }
+    if(myproc()->killed){
+      release(&ptable.lock);
+      return -EINTR;           // a signal arrived while waiting
     }
 
     if (options & 1) { // WNOHANG

kernel/sys/sys_fs.c

@@ -726,8 +726,8 @@ bad_unlink: iunlockput(dp); end_op(); return -1;
 
 addr_t sys_exec(void)
 {
-    char *path, *argv[MAXARG];
-    addr_t uargv, uarg;
+    char *path, *argv[MAXARG], *envp[MAXENV];
+    addr_t uargv, uenvp, uarg;
     if (argstr(0, &path) < 0 || argaddr(1, &uargv) < 0) return -EFAULT;
     memset(argv, 0, sizeof(argv));
     for (int i = 0; ; i++) {
@@ -736,7 +736,24 @@ addr_t sys_exec(void)
         if (!uarg) { argv[i] = 0; break; }
         if (fetchstr(uarg, &argv[i]) < 0) return -EFAULT;
     }
-    return exec(path, argv);
+
+    // The third argument. This is Linux's execve(2), so musl has been passing
+    // an environment here all along -- it was simply never read, and every
+    // program on the system started with an empty one.
+    //
+    // A null envp is legal and means exactly that. It is also what the
+    // first-party exec() wrapper passes, so old callers keep their old
+    // behaviour without knowing about this.
+    memset(envp, 0, sizeof(envp));
+    if (argaddr(2, &uenvp) == 0 && uenvp) {
+        for (int i = 0; ; i++) {
+            if (i >= NELEM(envp)) return -E2BIG;
+            if (fetchaddr(uenvp + sizeof(addr_t) * i, &uarg) < 0) return -EFAULT;
+            if (!uarg) { envp[i] = 0; break; }
+            if (fetchstr(uarg, &envp[i]) < 0) return -EFAULT;
+        }
+    }
+    return exec(path, argv, envp);
 }
 
 // ftruncate/truncate both grow and shrink. Growing used to be quietly dropped

kernel/sys/sys_mem.c

@@ -95,7 +95,11 @@ sys_mmap(void)
     for (int i = 0; i < NVMA; i++) {
         if (!myproc()->vma[i].used) { v = &myproc()->vma[i]; break; }
     }
-    if (!v) return -1;
+    // -ENOMEM, not -1. A bare -1 reaches musl as -EPERM, so a process that
+    // had simply used all NVMA slots was told "operation not permitted" --
+    // which sends you looking for a permission model this system does not
+    // have. malloc() turns either into NULL, but only one of them is a clue.
+    if (!v) return -ENOMEM;
 
     // Ignore non-zero hint addresses (not MAP_FIXED); always pick a fresh VA.
     // Bump-allocated: each mapping gets its own disjoint, exactly-length-sized