build: fix four things a clean build found, three of them mine

`make` had been failing since the e1000 work and I did not see it, because I
was checking build output with `grep error` -- which matches neither "Błąd" nor
mkfs's "image full". Checking the exit status instead found all of this in a
minute.

**usbstick.img was full.** `make ldls-stage` puts a module and its BTF in
sysroot/lib/modules, and a vmlinux BTF is 5 MB on its own; the 16 MB test image
could not hold it. The size cannot move -- tools/windows/bootcheck.ps1 asserts
READ CAPACITY returns exactly 32768 sectors -- so the exclusions grew instead:
lib and usr as well as bin. That image exists to prove the USB driver can read
one block, so its contents were never the point. It also stopped a GPL module
riding into a test artifact, which RAMDISK_EXCLUDE does for the ramdisk and
nothing was doing for this one.

**toybox's httpd was shadowing ours.** /bin/httpd answered `-p` with toybox's
"Unknown option 'p'", because whichever install rule ran second won the name.
TOYBOX_SKIP existed for exactly this and held one entry, `ping`, found the same
hard way. It is now generated from cmd/ -- a list you have to remember is a
list that is wrong the next time cmd/ grows, and it already was: `chvt` had
been silently toybox's, whose VT ioctls are Linux's and not ours.

**ldlsd would not link with clang.** `*out = in;` on a 96-byte struct is a call
to memcpy as far as the C standard is concerned; gcc unrolled it and clang
emitted the call, so a freestanding program linked for months and then did not
on a machine where nothing about it had changed but the compiler. lib/glue.c
now provides memcpy, memmove, memset and memcmp -- the four an implementation
may call without being asked.

**OVMF was never found on NixOS.** `$(dir $(QEMU))share` is the *bin*
directory plus "share", so it looked in /usr/bin/share. The absolute paths
after it covered that up on distributions that keep firmware in /usr; on one
that keeps nothing there it meant the firmware was undiscoverable on a machine
that had it, and the only way to build was to copy the file in by hand. It
resolves the prefix properly now and looks in <prefix>/share/qemu too.

Verified by exit status, from a clean tree and a no-op: both 0. ldls-check
passes 27. The guest boots, serves /srv to the host and answers 403 to
%2e%2e/etc/passwd.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

Makefile

@@ -527,9 +527,18 @@ OVMF_VARS = $(BUILD)/OVMF_VARS.fd
 # rather than assume, and say something useful when nothing is found -- an
 # unhelpful "cp: no such file" is a poor way to learn that a package is
 # missing.
-QEMU_SHARE  = $(dir $(shell command -v $(QEMU) 2>/dev/null))share
+#
-OVMF_CODE_CANDIDATES =     $(QEMU_SHARE)/edk2-x86_64-code.fd     /usr/share/edk2/ovmf/OVMF_CODE.fd     /usr/share/OVMF/OVMF_CODE.fd     /usr/share/ovmf/x64/OVMF_CODE.fd     /usr/share/qemu/edk2-x86_64-code.fd
+# `$(dir ...)` of the binary is its *bin* directory, so the share directory is
-OVMF_VARS_CANDIDATES =     $(QEMU_SHARE)/edk2-i386-vars.fd     /usr/share/edk2/ovmf/OVMF_VARS.fd     /usr/share/OVMF/OVMF_VARS.fd     /usr/share/ovmf/x64/OVMF_VARS.fd     /usr/share/qemu/edk2-i386-vars.fd
+# one level above it -- `$(dir)/share` asked for `/usr/bin/share`, which exists
+# nowhere. On the distributions below that went unnoticed, because the absolute
+# paths after it matched anyway; on one that keeps nothing in /usr it meant the
+# firmware was never found on a machine that had it, and the only way to build
+# was to copy the file in by hand.
+QEMU_BIN    = $(shell command -v $(QEMU) 2>/dev/null)
+QEMU_PREFIX = $(patsubst %/bin/,%,$(dir $(QEMU_BIN)))
+QEMU_SHARE  = $(QEMU_PREFIX)/share
+OVMF_CODE_CANDIDATES =     $(QEMU_SHARE)/qemu/edk2-x86_64-code.fd     $(QEMU_SHARE)/edk2-x86_64-code.fd     /usr/share/edk2/ovmf/OVMF_CODE.fd     /usr/share/OVMF/OVMF_CODE.fd     /usr/share/ovmf/x64/OVMF_CODE.fd     /usr/share/qemu/edk2-x86_64-code.fd
+OVMF_VARS_CANDIDATES =     $(QEMU_SHARE)/qemu/edk2-i386-vars.fd     $(QEMU_SHARE)/edk2-i386-vars.fd     /usr/share/edk2/ovmf/OVMF_VARS.fd     /usr/share/OVMF/OVMF_VARS.fd     /usr/share/ovmf/x64/OVMF_VARS.fd     /usr/share/qemu/edk2-i386-vars.fd
 
 # Tested through the shell rather than with $(wildcard). On Windows, make is a
 # native binary using Win32 file calls while `command -v` hands back an MSYS
@@ -1125,16 +1134,28 @@ $(BUILD)/sysroot.stamp: sysroot-install
 #     4096. The size is load-bearing: tools/windows/bootcheck.ps1 asserts on
 #     READ CAPACITY returning 32768 sectors of 512 bytes, which is this.
 #
-#     --exclude bin, because this image exists to prove the USB driver can read
+#     The exclusions matter more than they look, because the size above cannot
-#     a block and for no other reason. mkfs writes each hard link as its own
+#     move to accommodate content. This image exists to prove the USB driver
-#     copy, so once toybox's 236 applets became links to one binary the /bin
+#     can read a block and for no other reason, so what is in it is irrelevant
-#     tree expanded to more than 60 MB on the way in -- 236 copies of something
+#     and only its total size is not.
-#     nothing here will ever execute.
+#
+#     --exclude bin: mkfs writes each hard link as its own copy, so once
+#       toybox's applets became links to one binary the /bin tree expanded to
+#       more than 60 MB on the way in -- hundreds of copies of something
+#       nothing here will ever execute.
+#     --exclude lib: `make ldls-stage` puts a kernel module and its BTF here,
+#       and a vmlinux BTF is 5 MB on its own. That filled this image and broke
+#       `make` for anyone who had staged a module -- a build failure a long way
+#       from its cause. It also kept somebody else's GPL module out of a test
+#       artifact, which RAMDISK_EXCLUDE does for the ramdisk and nothing was
+#       doing for this.
+#     --exclude usr: 7 MB of fonts, for a test that reads one block.
 USBSTICK = $(BUILD)/usbstick.img
 $(USBSTICK): $(MKFS) $(BUILD)/sysroot.stamp
 	@mkdir -p $(BUILD)
 	@rm -f $@
-	$(MKFS) $@ --size 4096 --exclude bin --sysroot $(SYSROOT)
+	$(MKFS) $@ --size 4096 --exclude bin --exclude lib --exclude usr \
+	    --sysroot $(SYSROOT)
 
 usbstick: $(USBSTICK)
 

lib/glue.c

@@ -16,6 +16,71 @@ exit(void)
 /* _start lives in lib/start.S — it must read incoming registers, which
  * cannot be expressed portably in C. See that file. */
 
+// The four the compiler is allowed to call without being asked.
+//
+// A freestanding build gets no libc, but it does not get a compiler that
+// promises never to *call* one: the C standard lets an implementation emit
+// calls to memcpy, memmove, memset and memcmp for things that look nothing
+// like a function call. A struct assignment is the common one --
+//
+//     *out = in;                  /* struct pciuser_info, 96 bytes */
+//
+// -- which gcc unrolled into stores and clang turned into `call memcpy`, so
+// ldlsd linked for months and then did not, on a machine where nothing about
+// it had changed except which compiler ran. The fix is not to avoid struct
+// assignment; it is to provide the four functions, because the compiler is
+// within its rights either way.
+//
+// Deliberately simple. These are not the hot path of anything here, and a
+// clever one risks being turned back into a call to itself.
+void *
+memcpy(void *dst, const void *src, unsigned long n)
+{
+    unsigned char *d = dst;
+    const unsigned char *s = src;
+    while (n--) *d++ = *s++;
+    return dst;
+}
+
+void *
+memmove(void *dst, const void *src, unsigned long n)
+{
+    unsigned char *d = dst;
+    const unsigned char *s = src;
+
+    if (d == s || n == 0)
+        return dst;
+    // Backwards when they overlap the wrong way, which is the whole reason
+    // this is not memcpy.
+    if (d < s) {
+        while (n--) *d++ = *s++;
+    } else {
+        d += n; s += n;
+        while (n--) *--d = *--s;
+    }
+    return dst;
+}
+
+void *
+memset(void *dst, int c, unsigned long n)
+{
+    unsigned char *d = dst;
+    while (n--) *d++ = (unsigned char)c;
+    return dst;
+}
+
+int
+memcmp(const void *a, const void *b, unsigned long n)
+{
+    const unsigned char *p = a, *q = b;
+    while (n--) {
+        if (*p != *q)
+            return *p - *q;
+        p++; q++;
+    }
+    return 0;
+}
+
 void
 __stack_chk_fail(void)
 {

ports/toybox/Makefile

@@ -18,9 +18,20 @@ include ../mk/port.mk
 # applet replaced the shared inode and every applet became ping; installing
 # the applet over first-party ping put it back and lost the real one.
 #
-# SchOS's ping talks to its own lwIP stack and knows there is no resolver yet.
+# SchOS's ping talks to its own lwIP stack. toybox's would be the wrong answer
-# toybox's would be the wrong answer even if it worked.
+# even if it worked.
-TOYBOX_SKIP = ping
+#
+# The list is generated rather than remembered, because remembering it failed:
+# `ping` was found the hard way, and then `httpd` was found the same hard way
+# months later -- /bin/httpd ran, printed toybox's "Unknown option 'p'" and
+# nobody could see why the web server had no -p flag. Anything in cmd/ that
+# toybox also provides belongs here, and asking the directory is the only
+# version of that which stays true when cmd/ grows.
+#
+# `chvt` is in the list for the same reason and was never noticed: toybox's
+# wants Linux's VT ioctls, ours talks to SchOS's own terminal layer, and which
+# one you got depended on the order two install rules happened to run in.
+TOYBOX_SKIP = $(notdir $(wildcard $(TOPDIR)/cmd/*))
 
 TOYBOX_VERSION := 0.8.12
 TOYBOX_URL     := http://landley.net/toybox/downloads/toybox-$(TOYBOX_VERSION).tar.gz
@@ -130,7 +141,10 @@ $(BUILDDIR)/toybox.installed: $(BUILDDIR)/toybox | $(SYSROOT)/bin
 	    ln $(SYSROOT)/bin/toybox $(SYSROOT)/bin/"$$a" 2>/dev/null \
 	      || cp $< $(SYSROOT)/bin/"$$a"; \
 	done
-	@echo "toybox: installed $$($(BUILDDIR)/toybox | wc -w) applets"
+	@echo "toybox: installed $$($(BUILDDIR)/toybox | wc -w) applets, minus" \
+	      "$$(for a in $$($(BUILDDIR)/toybox); do \
+	            case " $(TOYBOX_SKIP) " in *" $$a "*) echo $$a ;; esac; \
+	          done | tr '\n' ' ')(first-party)"
 	@touch $@