kernel: processes have an environment now, and zsh is the shell

Porting zsh found four defects in the kernel and one in the filesystem. None
of them were about zsh; all of them had been there the whole time.

**exec threw the environment away.** kernel/fs/exec.c wrote a single zero for
envp with the comment "(no environment)" -- not yet, but ever, for every
process. musl has been passing a perfectly good envp to execve (Linux 59, which
SchOS answers) and it was never read. So $TERM was unset, $PATH was whatever
each program invented, and a variable exported in a shell did not survive the
exec meant to carry it. exec() takes an envp, sys_exec reads argument three,
and schinit manifests grew an Environment key. The userland two-argument
exec(path, argv) stays as a wrapper that passes null explicitly -- the raw stub
is execve now, so a short caller cannot leave %rdx holding a stray pointer.

**Which overflowed the kernel stack.** Three pointer arrays, ~1.8 KB, on a
4096-byte stack, under exec -> loaduvm -> readi -> SchFS -> btree. Pid 1 went
down on the first exec. The canary caught it and named the process, which is
what it is for. They live in one kalloc'd page now.

**waitpid returned a bare -1** for both "no children" and "interrupted". musl
reads [-4095,-1] as -errno, so userspace saw EPERM; zsh printed "wait failed:
operation not permitted" and abandoned the rest of /etc/zsh/zshrc. -ECHILD and
-EINTR now. Third time a bare -1 has cost real time -- on a system with no
permission model, EPERM should be read as "a syscall returned -1".

**NVMA was 64.** musl's allocator takes a mapping per size class and does not
release them eagerly, so compinit ran out of slots and got -1, which is EPERM,
which malloc turns into NULL, which zsh reports as "fatal error: out of memory"
-- on a machine with 1000 MB free. 256 slots, and -ENOMEM.

**And a small write to SchFS costs 58 ms.** 200 writes to one open file take
11.75 s; the same to /dev/null take 0.14 s. That is the design stated at the
top of kmount.c -- one transaction group per operation, and a commit is two
flushes and an uberblock -- not a bug. But compdump writes its digest with
thousands of separate prints, so it takes minutes and looks like a hang.
compinit -D, which skips the dump, finishes in 3.6 s. This one is a decision
rather than a fix, so it is written up and left: /etc/zsh/zshrc keeps compinit
switched off and explains exactly why, with the measurements.

zsh runs as /bin/zsh and is the console shell. ZLE works -- arrow keys recall
history through terminfo, $COLUMNS reads the real 160 because TIOCGWINSZ was
fixed, colour and prompt expansion work, startup is 0.14 s. mksh keeps /bin/sh,
so schinit's no-jobs fallback is a different program from the one that could
have failed.

Also fixed while here: AT_CLKTCK was the literal 100 and is USER_HZ; the
extract rule in four ports could move a source tree inside itself when make
re-ran it, which is how zsh's configure came to write modfile=zsh-5.9/... into
config.modules and fail three steps later.

schfs-check passes. Full writeup in docs/history/kernel.md section 14.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/fs/exec.c

@@ -18,20 +18,39 @@
 extern int linux_syscall_map[];
 extern int linux_syscall_map_size;
 
+// envp may be null, which means "no environment" -- the same thing this
+// function used to do unconditionally.
 int
-exec(char *path, char **argv)
+exec(char *path, char **argv, char **envp)
 {
   uint64 _t0 = rdtsc();
   fsstat.exec_calls++;
   char *s, *last;
   int i, off;
-  uint64 argc, sz, sp, ustack[MAXARG+1];
+  uint64 argc, envc, sz, sp;
   struct elfhdr elf;
   struct inode *ip;
   struct proghdr ph;
   pml4e_t *pgdir, *oldpgdir;
-  uint64 stack_slots[MAXARG + 32];
   int slot;
+
+  // The three pointer arrays live on the heap, not on the kernel stack.
+  //
+  // Together they are about 1.8 KB, and KSTACKSIZE is 4096 -- with the call
+  // chain under this function running exec -> loaduvm -> readi -> SchFS ->
+  // btree, there is not 1.8 KB to spare. Putting them here overflowed the
+  // stack on the first exec after the environment was added, and the canary
+  // in param.h caught it on pid 1 before it could corrupt anything.
+  //
+  // One page holds all three with room over.
+  uint64 *scratch = (uint64*)kalloc();
+  if(!scratch)
+    return -1;
+  uint64 *ustack      = scratch;                      /* MAXARG+1  */
+  uint64 *estack      = ustack + MAXARG + 1;          /* MAXENV+1  */
+  uint64 *stack_slots = estack + MAXENV + 1;          /* the rest   */
+  _Static_assert((MAXARG + 1 + MAXENV + 1 + MAXARG + MAXENV + 32) * 8 <= 4096,
+                 "exec scratch does not fit in one page");
   uint64 max_sz = 0;
   uint64 rand_va = 0;
 
@@ -97,6 +116,19 @@ exec(char *path, char **argv)
     ustack[argc] = sp;
   }
 
+  // The environment, copied the same way and for the same reason: these
+  // strings live in the *old* address space, which is still mapped, and will
+  // not be once the new pgdir is installed.
+  for(envc = 0; envp && envp[envc]; envc++) {
+    if(envc >= MAXENV)
+      goto bad;
+    sp -= strlen(envp[envc]) + 1;
+    sp &= ~7;
+    if(copyout(pgdir, sp, envp[envc], strlen(envp[envc]) + 1) < 0)
+      goto bad;
+    estack[envc] = sp;
+  }
+
   // Push 16 pseudo-random bytes for AT_RANDOM.
   {
     uint8 randbuf[16];
@@ -117,13 +149,20 @@ exec(char *path, char **argv)
   }
   stack_slots[slot++] = 0;    // end of argv
 
-  stack_slots[slot++] = 0;    // end of envp (no environment)
+  // The environment used to be a single zero here, with the comment "(no
+  // environment)". Nothing on SchOS had one: not a shell, not a musl program
+  // that had just called execve with a perfectly good envp, not anything. So
+  // $TERM was unset, $PATH was whatever each program invented, and a variable
+  // exported in a shell did not survive the exec that was supposed to carry it.
+  for(i = 0; i < envc; i++)
+    stack_slots[slot++] = estack[i];
+  stack_slots[slot++] = 0;    // end of envp
 
   // Auxiliary vector — musl reads these for page size, clock, etc.
   stack_slots[slot++] = 6;    // AT_PAGESZ
   stack_slots[slot++] = 4096;
   stack_slots[slot++] = 17;   // AT_CLKTCK
-  stack_slots[slot++] = 100;
+  stack_slots[slot++] = USER_HZ;   // what times() is scaled to, not a literal
   stack_slots[slot++] = 23;   // AT_SECURE = 0 (not setuid)
   stack_slots[slot++] = 0;
   stack_slots[slot++] = 11;   // AT_UID
@@ -232,10 +271,12 @@ exec(char *path, char **argv)
 
   switchuvm(myproc());
   freevm(oldpgdir);
+  kfree((char*)scratch);
   fsstat.exec_cycles += rdtsc() - _t0;
   return 0;
 
  bad:
+  kfree((char*)scratch);
   if(pgdir)
     freevm(pgdir);
   if(ip){