@ai-ecoverse/slicc-kernel 1.98.4 → 1.99.0

package/README.md

@@ -278,6 +278,36 @@ On top of preview1 a WASI program gets:
   - **Toolchain problems:**
     - **wasix-sysroot 2025.9.30-28's `epoll_ctl`:** it passes Linux's operation numbers (ADD 1, DEL 2, MOD 3) to WASIX untranslated, where WASIX numbers them ADD 0, MOD 1, DEL 2. The kernel takes both: 0 adds, 2 deletes, 3 modifies, and 1 adds a descriptor that isn't registered and modifies one that is. So a C program's second ADD of a descriptor modifies it rather than failing with `EEXIST`, and a WASIX MOD of an unregistered one adds it. That libc also returns the error number instead of -1, so its callers can't see a failure. Fixing the sysroot is [homescoop#443](https://github.com/ai-ecoverse/homescoop/issues/443); dropping the dual numbering once the fixed sysroot ships is [#684](https://github.com/ai-ecoverse/slicc-kernel/issues/684).
     - **The WASIX mio fork (1.0.3+wasix.1):** it opens its sockets blocking, unlike upstream mio's `SOCK_NONBLOCK`. On a socket whose send buffer is full, a tokio program blocks its runtime's thread, as it would on Wasmer.
+- **Named semaphores** (#717): `sem_open` and its family are kernel objects, so processes share them by name. Python's `multiprocessing` `Lock`, `Queue` and `Pool` use them; wasix-libc's `sem_*` calls these imports. Every import returns a WASI errno, and handles are u32 ≥ 1:
+  - **The imports:**
+    - `slicc.sem_open(name_ptr, name_len, oflag, mode, value, handle_out)`;
+    - `slicc.sem_close(handle)`;
+    - `slicc.sem_unlink(name_ptr, name_len)`;
+    - `slicc.sem_post(handle)`;
+    - `slicc.sem_wait(handle, how, clock, deadline_ns: i64)`;
+    - `slicc.sem_getvalue(handle, value_out)`.
+  - **Names:** checked as musl's are. Leading `/`s are skipped, so `/a` and `a` are one semaphore. Another `/`, an empty name, `.` or `..` is `EINVAL`, and more than 251 bytes is `ENAMETOOLONG`.
+  - **`sem_open` arguments:**
+    - `oflag` is the kernel's own bits, `1` for `O_CREAT` and `2` for `O_EXCL`, not libc's `O_*` values;
+    - `mode` has the process's umask applied;
+    - `value` must be 0 to `SEM_VALUE_MAX` (2^31-1), else `EINVAL`.
+  - **`sem_open` results:**
+    - an existing name with `O_CREAT|O_EXCL` is `EEXIST`, and a missing one without `O_CREAT` is `ENOENT`;
+    - with users on, opening needs read and write permission by the mode and owner, and only the owner or root may `sem_unlink`. A denial goes to `onDenial` as `sem_open` or `sem_unlink` of `/dev/shm/sem.<name>`: `enforce` refuses it with `EACCES`, `report` logs it and goes ahead;
+    - opening a semaphore the process already has open returns the same handle (one `sem_close` per open).
+  - **Waiting:**
+    - `how` 0 blocks; 1 tries (`EAGAIN`); 2 waits until `deadline_ns` on `clock` (0 `CLOCK_REALTIME`, as `sem_timedwait`; 1 `CLOCK_MONOTONIC`, as `sem_clockwait`).
+    - A timed wait gives `ETIMEDOUT`, never early, also when the deadline has already passed. A negative deadline is `EINVAL`.
+    - A wait blocks only its own thread, and a signal handler ends it with `EINTR`.
+  - **Posting:** `sem_post` gives the unit to the longest-waiting thread, or adds it to the value; at the maximum it's `EOVERFLOW`.
+  - **Lifetime:**
+    - A forked child inherits the open handles; spawn and exec start with none, and exit closes them.
+    - `sem_unlink` removes the name, but the semaphore lives on while handles to it remain.
+    - Nothing is undone when a process exits.
+  - **Limits:**
+    - Semaphores exist only within one kernel (not across tabs), and they don't appear in `/dev/shm`.
+    - A kernel holds at most 4,096 named ones (`ENOSPC`), and a process at most 256 open handles (`EMFILE`; a refused `O_CREAT` leaves no name behind).
+    - `MAP_SHARED` mappings aren't shared between processes, so unnamed semaphores (`sem_init` with `pshared`) work only between a process's threads, and `multiprocessing.shared_memory` doesn't work.
 - **Foreign calls** (libffi's WASIX backend, so Python's `ctypes`): `call_dynamic` calls a function through the program's indirect function table (a static module's exported `__indirect_function_table`, or the dynamic linker's), its arguments and results packed in memory one after another (`i32`/`f32` 4 bytes, `i64`/`f64` 8). With `strict` set, the buffers must fit the function exactly (else `EINVAL`, before the function is called); without it, missing arguments are zero (one cut short keeps the bytes given, with zeros above them) and results that do not fit are left out. A trap or exception of the callee goes through to the caller. JS cannot ask a function for its type, so the kernel reads the types from the module files (the program's and each side module's, once, when a program first calls through `call_dynamic`): a table slot that is empty, past the end, holds a function of no module the kernel knows of, or takes or returns a `v128`, gives `EINVAL`. For closures (callbacks such as `CFUNCTYPE`), a dynamically linked program gets table slots from `closure_allocate`, and `closure_free` gives them back for reuse and empties the slot in every thread; a static program gets `ENOTSUP`. `closure_prepare` puts a trampoline with the requested signature (any of `i32`, `i64`, `f32`, `f64`, `v128`) into such a slot, in every thread: each call stores its arguments below the stack pointer and calls the backing function as `backing(values, results, user_data)`, then returns what it wrote to `results`. The trampolines are small wasm modules made and compiled at run time, once per signature in each thread (an instance per closure), so a page whose Content Security Policy forbids compiling WebAssembly (no `'wasm-unsafe-eval'`) cannot run them; it cannot run the program either. A `fork` or a `longjmp` (both through Asyncify) inside a function reached through `call_dynamic` cannot unwind through it.
 - **Job control:** `^Z`, `SIGTSTP`, `SIGTTIN` and `SIGTTOU` stop a WASIX program at once, unless it has a handler for them. A stopped program that is busy computing is stopped for job control (`jobs` shows it, `fg`, `bg` and `SIGCONT` work), but its worker keeps a core busy until its next system call, since a worker's running code cannot be frozen from outside. Agents should `kill` such a job rather than leave it stopped. An Emscripten program stops at its next kernel call as well, and at its next write, read or sleep that its glue answers without the kernel (a write to its own `/dev/null`, as in `yes > /dev/null`), so a stopped one keeps no core busy unless it computes without any of these calls. A stopped program doesn't move on while stopped: a `sleep` (or a blocked read) that would end meanwhile ends after `SIGCONT`. A signal for such a program is also delivered at those glue-answered calls, so a handler runs in a loop that only writes to `/dev/null`. For the same reason, a signal with a handler or a terminating default (`^C`, `SIGTERM`) reaches a program that is busy computing only at its next system call, so a CPU-bound loop may not end on `^C`; `kill -9` always ends it. A pending signal is delivered at the program's next WASI or WASIX call, including the calls its worker answers without the kernel (`random_get`, `args_get`, …), except the exempt ones: `clock_time_get` (a tight loop of it measured up to 30% slower), `proc_exit`, `proc_exit2`, `thread_exit`, `thread_spawn_v2` and `wasi.thread-spawn` (wasi-threads), the calls that install handlers (`callback_signal`, `slicc.sigaction_set`), and calls made while Asyncify unwinds or rewinds the stack for `fork` or `longjmp`. A signal that arrives while a thread computes is thus delivered at its next call; when that call is a wait (`poll_oneoff` with a timeout or a descriptor, so `nanosleep` and `poll`/`select` too, `sigmask_poll`, or a futex wait), the handler has run during the call, so the wait ends at once: `EINTR` for a libc of -22 or later (an older one sees its clocks fire, as for any interruption), and a futex wait returns woken. A thread blocked in the kernel or waiting on a lock (`pthread_cond_wait`, a futex) is woken by a signal for it (a futex wait checks for signals every 50 ms, so each waiting thread wakes briefly that often), and `pthread_kill` runs the handler on the thread it names. A sleep, or a clock in `poll_oneoff`, never ends before the time asked (it can end later, never earlier). A signal that ends a sleep or a `poll`/`select` with a timeout makes the call fail with `EINTR` in a program whose libc says it is wasix-sysroot 2025.9.30-22 or later (its `slicc.libc` custom section). Older libcs turn that answer into `ENOTSUP` from `nanosleep` (up to -18), so for a program without the section the wait ends as if it had timed out, unless it imports `fd_fdflags_set` (then `EINTR`, as before).
 - **Blocked signals** (`sigprocmask`, `pthread_sigmask`, `sigpending`): a program whose libc imports `slicc.sigmask_set(how, set_lo, set_hi, old_ptr)` and `slicc.sigpending_get(ptr)` (wasix-sysroot 2025.9.30-28 and later) has a blocked mask per thread. `how` is musl's `SIG_BLOCK` 0, `SIG_UNBLOCK` 1 or `SIG_SETMASK` 2, the set is the 64-bit `sigset_t` (bit `sig - 1`), and the old mask is written as a u64 at `old_ptr`; any other `how` is `EINVAL`. `SIGKILL` and `SIGSTOP` cannot be blocked. A blocked signal is not delivered, does not interrupt a sleep or a blocked call, and its default action (terminate or stop) waits: it stays pending, `sigpending` shows it (the thread's pending signals and the process's), and it is delivered when it is unblocked, before `sigmask_set` returns. A signal ignored with `SIG_IGN` is discarded even while blocked. A forked child (with the mask of the thread that forked), the program an `exec` starts and a spawned child keep the mask, all 64 bits of it, and so does a new thread; `/proc/<pid>/status` shows the main thread's as `SigBlk`. The mask is kept in a word of the worker's shared header, so changing it costs no kernel call. A program without the import (an older libc) has no mask and gets every signal at once, as before, and one it starts by `exec` with a mask set starts with none. A signal for the whole process goes to the main thread, even if the main thread blocks it and another thread does not. A signal sent to one thread (`pthread_kill`) that it blocks waits for that thread, and if it has no handler, the thread's unblock ends the whole process by the signal, whatever the other threads block. `slicc.sigmask_poll(set_lo, set_hi, in_ptr, out_ptr, nsubscriptions, nevents_ptr)` is `pselect`, `ppoll` and `sigsuspend`: it swaps the thread's mask to the given set for the call and puts the old one back before it returns. It delivers a pending signal the new mask unblocks, without polling, or polls as `poll_oneoff` does, under the new mask, so a signal it unblocks interrupts the wait with no window between the swap and the wait; with no subscriptions it waits until a signal is delivered. An interrupted call returns `EINTR` with no events, after the handler has run.
@@ -933,6 +963,17 @@ Each side prints `pattern` (a static array's damage), `low` (bytes of low memory
 
 **Build:** `WASIX_SYSROOT_28=/path/to/wasix-sysroot ./build.sh`, with `wasixcc` 0.4.7 and binaryen's `wasm-opt` (version 132) on `PATH`. `bin/piefork.wasm` is 823,983 bytes, sha256 `0477598c71b02356145d1725548ee0f2b9e53ca0d43c7349f17acc2ff12b59f8`.
 
+### `semtest`
+
+A WASIX C program for `test/integration/semaphore.test.mjs` (#717). It calls the `slicc.sem_*` imports directly (`import_module("slicc")`), so the rows don't wait for the libc side. `semtest MODE` runs one of:
+- `handoff`, `inherit`, `spawn` (a spawned and an exec'd image open the semaphore by name; exec drops the handles);
+- `try`, `timed`, `eintr`;
+- `threads` (FIFO, one thread blocked at a time);
+- `errors`, `unlink`, `owners setup|user`;
+- `killed` (a waiter killed before posts loses no unit), `exited`, `cap`, `handles`.
+
+**Build:** `WASIX_SYSROOT_28=/path/to/wasix-sysroot ./build.sh`, with `wasixcc` 0.4.7 (legacy exceptions, `-pthread`) and binaryen's `wasm-opt` (version 132, `--asyncify` for `proc_fork`) on `PATH`. `bin/semtest.wasm` is 59,187 bytes, sha256 `c2091c18d799881721bb8e0e2fc7269732d52d6cd545f4f57266e8e8864c9ee6`.
+
 ## License
 
 Apache-2.0

package/dist/kernel-worker.js

@@ -3052,6 +3052,7 @@ function kernelFdKind(file) {
 }
 var FdTable = class _FdTable {
   static MAX_FDS = 1024;
+  handles;
   fds = /* @__PURE__ */ new Map();
   cloexec = /* @__PURE__ */ new Set();
   status = /* @__PURE__ */ new Map();
@@ -3148,6 +3149,7 @@ var FdTable = class _FdTable {
     for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
     for (const fd of this.cloexec) child.cloexec.add(fd);
     for (const [fd, flags2] of this.status) child.status.set(fd, flags2);
+    child.handles = this.handles?.fork();
     return child;
   }
   async closeAll() {
@@ -3155,6 +3157,7 @@ var FdTable = class _FdTable {
     this.fds.clear();
     this.cloexec.clear();
     this.status.clear();
+    this.handles?.clear();
     await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
   }
 };
@@ -12082,7 +12085,7 @@ var PATH_OPS = new Set(SYNC_FS_OPS);
 var EARLY_WHOLE_FILE = 64 * 1024;
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.98.4" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.99.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -14516,6 +14519,206 @@ async function waitReady(fds, read, write, deadline, interrupted3) {
   }
 }
 
+// src/kernel/sem.ts
+var SEM_VALUE_MAX = 2147483647;
+var SEM_NAMES_MAX = 4096;
+var SEM_HANDLES_MAX = 256;
+var NAME_MAX = 251;
+var TIMER_MAX_MS = 2147483647;
+var SEM_OPS = [
+  "sem-open",
+  "sem-close",
+  "sem-unlink",
+  "sem-post",
+  "sem-wait",
+  "sem-getvalue"
+];
+var Semaphore = class {
+  value;
+  uid;
+  gid;
+  mode;
+  waiters = [];
+  constructor(value, uid, gid, mode) {
+    this.value = value;
+    this.uid = uid;
+    this.gid = gid;
+    this.mode = mode;
+  }
+  post() {
+    const next2 = this.waiters.shift();
+    if (next2) next2.grant();
+    else if (this.value >= SEM_VALUE_MAX) throw new KernelError("EOVERFLOW");
+    else this.value++;
+  }
+  take() {
+    if (this.value === 0) return false;
+    this.value--;
+    return true;
+  }
+  wait(signal, timeoutMs) {
+    if (this.take()) return Promise.resolve(true);
+    if (signal.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve2, reject) => {
+      const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : performance.now() + timeoutMs;
+      let timer;
+      const leave = () => {
+        const at = this.waiters.indexOf(waiter);
+        if (at >= 0) this.waiters.splice(at, 1);
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+      };
+      const waiter = {
+        grant: () => {
+          leave();
+          resolve2(true);
+        }
+      };
+      const abort = () => {
+        leave();
+        reject(new KernelError("EINTR"));
+      };
+      const expire = () => {
+        const left = deadline - performance.now();
+        if (left > 0) {
+          timer = setTimeout(expire, Math.min(left, TIMER_MAX_MS));
+          return;
+        }
+        leave();
+        resolve2(false);
+      };
+      this.waiters.push(waiter);
+      signal.addEventListener("abort", abort, { once: true });
+      if (deadline !== Number.POSITIVE_INFINITY) {
+        timer = setTimeout(expire, Math.min(timeoutMs, TIMER_MAX_MS));
+      }
+    });
+  }
+};
+var SemTable = class {
+  names = /* @__PURE__ */ new Map();
+  limit;
+  constructor(limit = SEM_NAMES_MAX) {
+    this.limit = limit;
+  }
+  open(name2, create, exclusive, make, check, adopt) {
+    const found = this.names.get(name2);
+    if (found) {
+      if (create && exclusive) throw new KernelError("EEXIST");
+      check(found);
+      return adopt(found);
+    }
+    if (!create) throw new KernelError("ENOENT");
+    if (this.names.size >= this.limit) throw new KernelError("ENOSPC");
+    const sem = make();
+    const handle = adopt(sem);
+    this.names.set(name2, sem);
+    return handle;
+  }
+  unlink(name2, check) {
+    const found = this.names.get(name2);
+    if (!found) throw new KernelError("ENOENT");
+    check(found);
+    this.names.delete(name2);
+  }
+};
+var SemHandles = class _SemHandles {
+  byHandle = /* @__PURE__ */ new Map();
+  next = 1;
+  add(sem) {
+    for (const [handle2, entry] of this.byHandle) {
+      if (entry.sem === sem) {
+        entry.opens++;
+        return handle2;
+      }
+    }
+    if (this.byHandle.size >= SEM_HANDLES_MAX) throw new KernelError("EMFILE");
+    const handle = this.next++;
+    this.byHandle.set(handle, { sem, opens: 1 });
+    return handle;
+  }
+  get(handle) {
+    const entry = this.byHandle.get(handle);
+    if (!entry) throw new KernelError("EINVAL");
+    return entry.sem;
+  }
+  close(handle) {
+    const entry = this.byHandle.get(handle);
+    if (!entry) throw new KernelError("EINVAL");
+    if (--entry.opens === 0) this.byHandle.delete(handle);
+  }
+  fork() {
+    const child = new _SemHandles();
+    child.next = this.next;
+    for (const [handle, entry] of this.byHandle) child.byHandle.set(handle, { ...entry });
+    return child;
+  }
+  clear() {
+    this.byHandle.clear();
+  }
+};
+function semName(raw) {
+  const name2 = raw.replace(/^\/+/, "");
+  if (name2 === "" || name2.includes("/") || name2 === "." || name2 === "..") {
+    throw new KernelError("EINVAL");
+  }
+  if (new TextEncoder().encode(name2).length > NAME_MAX) throw new KernelError("ENAMETOOLONG");
+  return name2;
+}
+var ok2 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
+async function semSyscall(req, proc) {
+  const { table, handles, cred } = proc;
+  if (!table) throw new KernelError("ENOSYS");
+  const { denied: denied2 } = proc;
+  const shown = (name2) => `/dev/shm/sem.${name2}`;
+  const opens = (name2) => (sem) => {
+    const perm = { uid: sem.uid, gid: sem.gid, mode: sem.mode };
+    if (denied2 && !permits(cred, perm, R_OK | W_OK, false)) denied2("sem_open", shown(name2));
+  };
+  const unlinks = (name2) => (sem) => {
+    if (denied2 && cred.euid !== 0 && cred.euid !== sem.uid) denied2("sem_unlink", shown(name2));
+  };
+  switch (req.op) {
+    case "sem-open": {
+      if (req.value < 0 || req.value > SEM_VALUE_MAX) throw new KernelError("EINVAL");
+      const name2 = semName(req.name);
+      const mode = req.mode & 511 & ~proc.umask;
+      return ok2(
+        table.open(
+          name2,
+          req.create,
+          req.exclusive,
+          () => new Semaphore(req.value, cred.euid, cred.egid, mode),
+          opens(name2),
+          (sem) => handles.add(sem)
+        )
+      );
+    }
+    case "sem-close":
+      handles.close(req.handle);
+      return ok2();
+    case "sem-unlink": {
+      const name2 = semName(req.name);
+      table.unlink(name2, unlinks(name2));
+      return ok2();
+    }
+    case "sem-post":
+      handles.get(req.handle).post();
+      return ok2();
+    case "sem-getvalue":
+      return ok2(handles.get(req.handle).value);
+    case "sem-wait": {
+      const sem = handles.get(req.handle);
+      if (sem.take()) return ok2();
+      if (req.how === "try") throw new KernelError("EAGAIN");
+      if (req.how === "timed" && req.timeoutMs === 0) throw new KernelError("ETIMEDOUT");
+      const got = await sem.wait(proc.blocking(), req.how === "block" ? -1 : req.timeoutMs);
+      if (!got) throw new KernelError("ETIMEDOUT");
+      return ok2();
+    }
+  }
+}
+
 // src/kernel/net/datagram-wire.ts
 function encodeReceived(got) {
   const host = new TextEncoder().encode(got.host);
@@ -14562,20 +14765,20 @@ function dgramAt(fds, fd) {
   if (!(file instanceof KernelDgram)) throw new KernelError("EOPNOTSUPP");
   return file;
 }
-var ok2 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
+var ok3 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
     case "sock-open": {
       if (req.type === "dgram" && req.domain !== "inet") throw new KernelError("EPROTONOSUPPORT");
       const file = req.type === "dgram" ? new KernelDgram(net) : net.socket(req.domain);
-      return ok2(fds.install(new OpenFile(file), 3));
+      return ok3(fds.install(new OpenFile(file), 3));
     }
     case "sock-pair": {
       const [a, b] = KernelSocket.pair(net, req.domain, proc.cred?.());
       const first = fds.install(new OpenFile(a), 3);
       try {
-        return ok2([first, fds.install(new OpenFile(b), 3)]);
+        return ok3([first, fds.install(new OpenFile(b), 3)]);
       } catch (e) {
         await Promise.resolve(fds.close(first));
         throw e;
@@ -14583,32 +14786,32 @@ async function socketSyscall(req, proc) {
     }
     case "sock-bind":
       anySocketAt(fds, req.fd).bind(req.addr);
-      return ok2();
+      return ok3();
     case "sock-listen":
       socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
-      return ok2();
+      return ok3();
     case "sock-accept":
-      return ok2(await accept(proc, req.fd, req.nonblock));
+      return ok3(await accept(proc, req.fd, req.nonblock));
     case "sock-connect":
       return connect(req, proc);
     case "sock-shutdown":
       anySocketAt(fds, req.fd).shutdown(req.how);
-      return ok2();
+      return ok3();
     case "sock-name": {
       const socket = anySocketAt(fds, req.fd);
       const addr = req.peer ? socket.peer : socket.local;
       if (req.peer && !addr) throw new KernelError("ENOTCONN");
-      return ok2(addr ?? unnamed(socket instanceof KernelDgram ? "inet" : socket.domain));
+      return ok3(addr ?? unnamed(socket instanceof KernelDgram ? "inet" : socket.domain));
     }
     case "sock-getopt":
-      return ok2(anySocketAt(fds, req.fd).getOption(req.level, req.name));
+      return ok3(anySocketAt(fds, req.fd).getOption(req.level, req.name));
     case "sock-setopt":
       anySocketAt(fds, req.fd).setOption(req.level, req.name, req.value);
-      return ok2();
+      return ok3();
     case "sock-resolve": {
       const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
       if (addresses.length === 0) throw new KernelError("ENOENT");
-      return ok2(addresses);
+      return ok3(addresses);
     }
     default:
       return datagram(req, proc);
@@ -14618,7 +14821,7 @@ async function connect(req, proc) {
   const target = anySocketAt(proc.fds, req.fd);
   if (target instanceof KernelDgram) {
     target.connectTo(req.addr);
-    return ok2();
+    return ok3();
   }
   const stamp = proc.net.facadeAt(req.addr) && await proc.stamp?.();
   const dialing = target.connect(req.addr, true, proc.cred?.(), stamp || void 0);
@@ -14627,13 +14830,13 @@ async function connect(req, proc) {
     throw new KernelError("EINPROGRESS");
   }
   if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
-  return ok2();
+  return ok3();
 }
 async function datagram(req, proc) {
   const dgram = dgramAt(proc.fds, req.fd);
   if (req.op === "sock-sendto") {
     if (req.nonblock && !pollFile(dgram).writable) throw new KernelError("EAGAIN");
-    return ok2(await dgram.send(req.body, req.addr));
+    return ok3(await dgram.send(req.body, req.addr));
   }
   const ready2 = pollFile(dgram).readable;
   if (req.nonblock && !ready2) throw new KernelError("EAGAIN");
@@ -15399,6 +15602,9 @@ function isHttpSyscall(req) {
 function isSocketSyscall(req) {
   return req.op.startsWith("sock-");
 }
+function isSemSyscall(req) {
+  return req.op.startsWith("sem-");
+}
 function isEpollSyscall(req) {
   return EPOLL_OPS.includes(req.op);
 }
@@ -15493,6 +15699,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "sig-pause",
   ...SOCKET_OPS,
   ...EPOLL_OPS,
+  ...SEM_OPS,
   ...HTTP_OPS,
   ...PTY_OPS,
   ...HOST_OPS
@@ -15725,6 +15932,7 @@ var WasmProcess = class {
       if (isTtySyscall(req)) return this.ttySyscall(req);
       if (isJobSyscall(req)) return this.jobSyscall(req);
       if (isSocketSyscall(req)) return await this.socketSyscall(req, cancelled);
+      if (isSemSyscall(req)) return await this.semSyscall(req, cancelled);
       if (isEpollSyscall(req)) {
         return await epollSyscall(req, {
           fds: this.fds,
@@ -16444,6 +16652,20 @@ var WasmProcess = class {
     if (!http) return Promise.resolve({ ok: false, errno: "ENETUNREACH", message: NO_TRANSPORT });
     return http.syscall(req);
   }
+  semSyscall(req, cancelled) {
+    const g = this.guarded();
+    const known = this.fds.handles;
+    const handles = known instanceof SemHandles ? known : new SemHandles();
+    this.fds.handles = handles;
+    return semSyscall(req, {
+      table: this.options.sems,
+      handles,
+      cred: this.cred,
+      denied: g ? (op, path) => deny(g, op, path) : void 0,
+      umask: this.umask,
+      blocking: () => this.blockingSignal(cancelled)
+    });
+  }
   socketSyscall(req, cancelled) {
     this.net ??= this.options.net ?? new LoopbackNet();
     const resolver = this.options.resolver ?? HOSTS_ONLY;
@@ -16954,6 +17176,7 @@ function processOptions(opts, header3, hooks, created3) {
     net: opts.net,
     http: opts.http,
     locks: opts.locks,
+    ...opts.sems ? { sems: opts.sems } : {},
     onReap: opts.onReap,
     resolver: opts.resolver,
     ...notifiers(header3),
@@ -20512,6 +20735,7 @@ var Launcher = class {
   sudoer;
   jobs = new JobTable();
   locks = new LockTable();
+  sems = new SemTable();
   settling = new SettlingChildren((pid) => this.jobs.pgidOf(pid));
   ptys = new PtyTable(
     (tty, sig) => this.keySignal(tty, 0, sig, () => this.jobs.signalOwnedForeground(tty, sig)),
@@ -21370,6 +21594,7 @@ var Launcher = class {
       net: this.net,
       http: new HttpHandles(this.transport, pid, this.loopbackFor(pid)),
       locks: this.locks,
+      sems: this.sems,
       resolver: this.resolver,
       onReap: (child) => this.reaped(child, pid),
       ...req.fork ? { fork: req.fork } : {},