exec: Linux's 2 MB of arguments; mmap: merge neighbouring mappings

exec took 32 arguments and 64 environment variables, in fixed arrays,
so a glob over more than 31 files failed with E2BIG. It now reads the
caller's argv and envp where they are, through the uaccess helpers and
a bounce page -- a second thread rewriting the array after a check
cannot slip a kernel address in -- and sizes the new stack to fit
them. The limits are Linux's: ARG_MAX, 2 MB of strings and pointers,
and 128 KB for any one string (USER_STR_MAX follows it).

Every mmap took one of a process's 256 VMA slots, and zsh takes one per
16 KB heap block, so `x=($(<file))` over 30000 words ran out after 4 MB
of heap and exited 1 without a word. Neighbouring anonymous mappings
now share a record, as Linux merges them -- the bump allocator puts
each new one where the last ended -- and munmap trims or splits it.
Partial unmaps of device or segment mappings are refused with EINVAL
instead of kfree()ing pages that are not the process's, and a failed
allocation half way through a mapping no longer leaks what it had.

Checked under QEMU: touch over 3000 names, /bin/echo with 50000
arguments, E2BIG past 2 MB, zsh splitting 100000 words, fork loops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

include/file.h

@@ -194,6 +194,9 @@ int ibusy(uint dev, uint64 except);
 // Path lookup that follows a final symlink too; 0 with *err set on failure.
 // `start` 0 means the cwd. In fs.c.
 struct inode *nameifollow(struct inode *start, char *path, int *err);
+// execve(2) with the argv and envp arrays still in the caller's memory. In
+// exec.c; exec() is the same for arrays the kernel holds.
+int exec_user(char *path, addr_t uargv, addr_t uenvp);
 
 // table mapping major device number to
 // device functions

include/param.h

@@ -42,8 +42,11 @@
 #else
 #define ROOTDEV        1  // device number of file system root disk
 #endif
-#define MAXARG        32  // max exec arguments
-#define MAXENV        64  // max environment variables passed through exec
+// exec's limits, Linux's: ARG_MAX bytes of argument and environment strings
+// and their pointers together, and no one string over ARG_STRLEN_MAX (Linux's
+// MAX_ARG_STRLEN). There is no limit on the count beyond that.
+#define ARG_MAX        (2 * 1024 * 1024)
+#define ARG_STRLEN_MAX (128 * 1024)
 #define MAXPATH       128 // max path 
 #define MAXOPBLOCKS   30  // max # of blocks any FS op writes
 #define LOGSIZE      (MAXOPBLOCKS*3)  // max data blocks in on-disk log

include/uaccess.h

@@ -39,7 +39,7 @@ int copy_to_user(addr_t uaddr, const void *src, uint64 n);
 #define put_user(x, uaddr)  copy_to_user((addr_t)(uaddr), &(x), sizeof(x))
 
 // Longest string fetchstr()/strlen_user() will scan before giving up.
-#define USER_STR_MAX 32768
+#define USER_STR_MAX (128 * 1024)   // = ARG_STRLEN_MAX: an argument is one
 
 // Length of the NUL-terminated string at uaddr (excluding the NUL),
 // validating every page it spans. -EFAULT if it runs off mapped memory