@ai-ecoverse/slicc-kernel 1.99.0 → 1.99.1

package/README.md

@@ -346,7 +346,7 @@ The module's default export (or its `main` export) is called with a context and
 - `fdStatus(fd)` (`{ type, tty, seekable }`, `type` being `file`, `pipe`, `tty`, `socket`, `device` or `directory`) and `isatty(fd)`, to tell `< file` from a pipe;
 - `open(path, { read, write, append, create, exclusive, truncate })`, which returns a file with `read(position, length)`, `write(position, bytes)`, `size()`, `truncate(size)`, `sync()` and `close()`. Reads and writes go through the kernel's paged files at those positions, so a large file is never read whole;
 - `fs`: `stat`, `lstat`, `exists`, `readdir`, `mkdir` (with parents, or, with `{ recursive: false }`, as Node's `fs.mkdir` without `recursive`: `EEXIST` for an existing entry and `ENOENT` for a missing parent, atomically among the processes of one kernel, so it can serve as a lock there, but not between two kernels on one origin, such as two tabs ([#519](https://github.com/ai-ecoverse/slicc-kernel/issues/519)); `sync.fs.mkdir` takes the same option), `rm` (recursive), `unlink`, `rename`, `symlink`, `readlink`, `statfs`, `chmod(path, mode)`, and `readFile`/`writeFile` for small files. `chmod` takes the permission bits (`0` to `0o7777`, `EINVAL` otherwise) and follows a symlink; as `chmod(2)`, only the file's owner or root may (`EPERM`), so a program can make a script it wrote runnable by path. `sync.fs.chmod` is the same, synchronously. `statfs(path)` answers `{ type, bsize, blocks, bfree, bavail, files, ffree, quota, usage }`: the fields of Node's `StatFs`, plus `quota` and `usage` in bytes (what jsh 0.17 reads). The values come from the same source as an Emscripten program's `statfs`/`df`: the driver of the mount the path is on, or, on the root file system, the origin's storage estimate (`navigator.storage.estimate()`). `bsize` is 4096, `bfree` and `bavail` are what's left of the quota, and `type`, `files` and `ffree` are 0, since the kernel doesn't know them. Where there's no estimate (the Node entry's root), every count is 0. A missing path is `ENOENT`. `sync.fs` has it too. `rm` removes a whole tree in one kernel call (on the OPFS root, one recursive removal and one metadata delete: 50,000 files take about 3 s in Chrome, where `rm -r` takes about 25 s) with the result of a file-by-file removal: symlinks inside the tree are removed, never followed; a tree holding a protected path is refused with `EROFS` and nothing is removed; a mount inside the tree is emptied and its mount point answers `EBUSY`, while the rest is removed; under `users`, what the user may remove is removed and the call then fails with the first `EACCES`/`EPERM`; files a process holds open stay readable to it;
-- `/dev`, in `open`, `fs` and their `sync` forms, as a WASI or Emscripten program sees it, with the same modes and owners as under `users`: `null`, `zero`, `full`, `random`, `urandom` and `tty` (character devices, `0666`, root's), `stdin`, `stdout` and `stderr` (links to `/proc/self/fd/0`, `1`, `2`), `fd` (a link to `/proc/self/fd`, so `/dev/fd/N` is descriptor N) and the kernel's terminals `/dev/ttyN` and `/dev/pts/N` (with users on, owned by the session's user or the master's opener, `0620`). `/dev/shm` and `/dev/ptmx` aren't there. `stat` through `/dev/stdin`, `/dev/stdout` or `/dev/fd/N` describes the program's own descriptor (the file it is redirected to, a pipe, a terminal), `readlink` of `/dev/fd/N` names it (`pipe:[N]` and `socket:[N]` for a pipe or a socket), and a closed descriptor is `ENOENT`. Opening a device gives a kernel descriptor on it; opening `/dev/std*` or `/dev/fd/N` opens the file again with the flags asked for when the descriptor is on a file (as Linux reopens `/proc/self/fd/N`, so `append` appends and `truncate` truncates), and otherwise duplicates the descriptor; `/dev/tty` is the program's controlling terminal (`ENXIO` without one); and `/dev/ttyN` and `/dev/pts/N` are opened by name through the kernel, so a terminal that isn't the user's is `EACCES` under `enforce`. A file on anything but a regular file reads and writes as a stream (the position is ignored) and only in the directions it was opened for (`EBADF` otherwise), its `size()` is 0 and `truncate` is `EINVAL`. `readFile` reads a device or a descriptor to its end, up to 64 MiB, and fails with `EFBIG` past that (where Node's `readFile` throws `ERR_FS_FILE_TOO_LARGE`), so `readFile('/dev/zero')` fails instead of hanging, while a bounded `read` of it works. Other paths pay only a prefix check: they make the same kernel calls as before. Creating, removing or renaming names in `/dev` goes to the root file system as before;
+- `/dev`, in `open`, `fs` and their `sync` forms, as a WASI or Emscripten program sees it, with the same modes and owners as under `users`: `null`, `zero`, `full`, `random`, `urandom` and `tty` (character devices, `0666`, root's), `stdin`, `stdout` and `stderr` (links to `/proc/self/fd/0`, `1`, `2`), `fd` (a link to `/proc/self/fd`, so `/dev/fd/N` is descriptor N) and the kernel's terminals `/dev/ttyN` and `/dev/pts/N` (with users on, owned by the session's user or the master's opener, `0620`). `/dev/shm` is the kernel's shared tmpfs (see [Mounts](#mounts)), read and written like any other mount; `/dev/ptmx` isn't there. `stat` through `/dev/stdin`, `/dev/stdout` or `/dev/fd/N` describes the program's own descriptor (the file it is redirected to, a pipe, a terminal), `readlink` of `/dev/fd/N` names it (`pipe:[N]` and `socket:[N]` for a pipe or a socket), and a closed descriptor is `ENOENT`. Opening a device gives a kernel descriptor on it; opening `/dev/std*` or `/dev/fd/N` opens the file again with the flags asked for when the descriptor is on a file (as Linux reopens `/proc/self/fd/N`, so `append` appends and `truncate` truncates), and otherwise duplicates the descriptor; `/dev/tty` is the program's controlling terminal (`ENXIO` without one); and `/dev/ttyN` and `/dev/pts/N` are opened by name through the kernel, so a terminal that isn't the user's is `EACCES` under `enforce`. A file on anything but a regular file reads and writes as a stream (the position is ignored) and only in the directions it was opened for (`EBADF` otherwise), its `size()` is 0 and `truncate` is `EINVAL`. `readFile` reads a device or a descriptor to its end, up to 64 MiB, and fails with `EFBIG` past that (where Node's `readFile` throws `ERR_FS_FILE_TOO_LARGE`), so `readFile('/dev/zero')` fails instead of hanging, while a bounded `read` of it works. Other paths pay only a prefix check: they make the same kernel calls as before. Creating, removing or renaming names in `/dev` goes to the root file system as before;
 - `/proc`, in `fs`, `open` and their `sync` forms, the same as a WASI program's (see [`/proc`](#proc)): `stat`, `lstat`, `exists`, `readdir`, `readlink` and `readFile` answer it, and `/proc/self` is the program's own pid. It's read-only, so every change in it is `EROFS`: `writeFile`, `mkdir`, `rm`, `unlink`, `chmod`, a `rename`, `link` or `symlink` into or out of it, and an `open` for writing, creating or truncating. A file opened in it is a snapshot read at the open, with no descriptor (`fd` is `-1`): its `read` and `size` answer from the snapshot until it's closed, and `write` and `truncate` are `EBADF`. Other paths pay only a prefix check;
 - `signals`: `on(signal, handler)` catches a signal (by number or as `'SIGINT'`), `ignore(signal)` ignores it and `reset(signal)` restores its default action. A call blocked in a read or write is restarted after a handler runs; signals without a handler keep their default actions, so an uncaught `SIGINT` ends the program with 130 and `SIGKILL` always does;
 - `sync`: `read`, `write`, `close`, `open` (whose files' methods are synchronous too) and `fs`, made synchronously, for code that cannot `await`, such as a compiled program's file system or a `readFileSync`. A synchronous call holds the worker until the kernel answers, so nothing else of the program runs meanwhile, timers and callbacks included; a signal that arrives during a blocked read or write runs its handler, and the call is then restarted. Descriptors are shared with the rest of the context, so a file opened with `sync.open` can be closed with `close`, and the other way around; `sync.run` and `sync.exit` are described next;
@@ -554,6 +554,8 @@ Directories are renamed with `FileSystemHandle.move()` where available, else by
 
 `kernel.mount({ type, source, target, options })` mounts a file system on an existing directory. Every process sees it, Emscripten and WASI alike, and so does every attached client. `kernel.umount(target)` unmounts it, and fails with `EBUSY` while a process has a file open under it. `kernel.mounts()` lists the table, as does `/proc/mounts`. The Node entry and attached clients have the same three calls (client protocol 1.2).
 
+`/dev/shm` is a tmpfs the kernel mounts at boot (source `shm`), mode `1777` and owned by root, so with `users` the sticky bit keeps one user from removing or renaming another's file there (`EPERM`). It's in `/proc/mounts`, but not in `kernel.mounts()`, which lists the mounts a caller made. Every process sees the same files, Emscripten (whose glue otherwise keeps a private `/dev/shm` in memory), WASI and JS programs alike, and they last until the kernel terminates, which is what musl's `shm_open` and `sem_open` need.
+
 - **Built in:** `tmpfs`, which lives in memory until unmounted, in 1 MiB chunks; `fsa`, a folder the user picks (see [Removable media](#removable-media-fsa)); and `hostfs`, a folder the local proxy exports (see [Host folders](#host-folders-hostfs)).
 - **Package drivers:** a package declares a type in `"slicc": { "filesystems": { "<type>": { "module": "<file>" } } }`, and the kernel starts that module in a worker of its own for each mount. The module is a single self-contained file: it can't import bare specifiers.
   - Its default export receives `{ fetch }`, the kernel's network transport. It returns `{ handlers, capabilities }`.

package/dist/kernel-worker.js

@@ -5063,7 +5063,7 @@ function serveClient(port, host) {
       case "umount":
         return { result: await l.umountAs(clientCred(self), req.target).then(() => true) };
       case "mounts":
-        return { result: l.mounts.list() };
+        return { result: l.mounts.listed() };
       case "dial":
         return dialFor(l, req, watches);
       case "serve-cdp":
@@ -8449,6 +8449,18 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
   };
 }
 
+// src/fs/dev-removal.ts
+var SHM = "/dev/shm";
+function inDevTree(path) {
+  if (path.startsWith(`${SHM}/`)) return false;
+  return path === "/dev" || path.startsWith("/dev/");
+}
+function devRemoval(path, cred) {
+  if (!inDevTree(path)) return void 0;
+  if (cred && cred.euid !== 0) return "EACCES";
+  return path === "/dev" ? "EBUSY" : "EPERM";
+}
+
 // src/fs/fresh-modules.ts
 var MAGIC = [0, 97, 115, 109];
 var MAX_FRESH = 65536;
@@ -9626,6 +9638,7 @@ var MountTable = class {
   devices = 0;
   pending = /* @__PURE__ */ new Set();
   notes = /* @__PURE__ */ new Map();
+  system = /* @__PURE__ */ new Set();
   deps;
   constructor(deps) {
     this.deps = deps;
@@ -9647,6 +9660,13 @@ var MountTable = class {
     const noted = [...this.notes.values()].filter((note) => !this.mounts.has(note.target));
     return [...mounted, ...noted.map((note) => ({ ...note, options: { ...note.options } }))];
   }
+  listed() {
+    return this.list().filter((entry) => !this.system.has(entry.target));
+  }
+  async mountSystem(spec, fs) {
+    await this.mount(spec, fs);
+    this.system.add(normalizePath(spec.target));
+  }
   note(spec, state, error) {
     const target = normalizePath(spec.target);
     this.notes.set(target, {
@@ -9753,6 +9773,7 @@ var MountTable = class {
     if (!mount && this.notes.delete(at)) return;
     if (!mount) throw errnoError("EINVAL", `${at} is not mounted`);
     if (!detach && this.deps.busy(at)) throw errnoError("EBUSY", `${at} has open files`);
+    this.system.delete(at);
     this.notes.delete(at);
     this.mounts.delete(at);
     this.deps.reshaped?.();
@@ -10661,16 +10682,6 @@ var MountFs = class _MountFs {
   }
 };
 
-// src/fs/dev-removal.ts
-function inDevTree(path) {
-  return path === "/dev" || path.startsWith("/dev/");
-}
-function devRemoval(path, cred) {
-  if (!inDevTree(path)) return void 0;
-  if (cred && cred.euid !== 0) return "EACCES";
-  return path === "/dev" ? "EBUSY" : "EPERM";
-}
-
 // src/realm/sync-fs-token-registry.ts
 var registry = /* @__PURE__ */ new Map();
 function mintSyncFsToken(entry) {
@@ -12085,7 +12096,7 @@ var PATH_OPS = new Set(SYNC_FS_OPS);
 var EARLY_WHOLE_FILE = 64 * 1024;
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.99.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.99.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -20547,6 +20558,9 @@ var NOT_EXECUTABLE = 126;
 var DECIDE_MS = 100;
 var INIT_PID = 1;
 var SHARED_DIRS = ["/tmp", "/home"];
+function unref2(port) {
+  port.unref?.();
+}
 var LAYOUT = [
   ["/", 493],
   ["/root", 448],
@@ -20757,6 +20771,7 @@ var Launcher = class {
   pnpmMade;
   pnpmEpoch = 0;
   mounts;
+  shmPorts = [];
   createDriverWorker;
   media;
   onMountPending;
@@ -22021,6 +22036,7 @@ var Launcher = class {
         },
         { owned: true }
       );
+      if (spec.target === SHM) this.shmPorts = [port1, port2];
       return {
         port: port1,
         dispose: () => {
@@ -22123,6 +22139,12 @@ var Launcher = class {
     this.pnpmStale();
     return entry;
   }
+  async mountShm() {
+    await this.base.mkdir(SHM, { recursive: true });
+    await this.mounts.mountSystem({ type: "tmpfs", source: "shm", target: SHM }, this.fs);
+    for (const port of this.shmPorts) unref2(port);
+    await this.fs.chmod(SHM, 1023);
+  }
   async ownTmp() {
     const real = await this.realLayoutPath("/tmp");
     const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
@@ -22279,6 +22301,7 @@ var Launcher = class {
     await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
     if (this.owners) await this.ownTmp();
+    await this.mountShm();
     await this.pnpmReady();
     await this.users.ensure();
     if (this.owners) await this.stampLayout();
@@ -22827,7 +22850,7 @@ function serveKernel(port, deps) {
     if (req.op === "mount") return l.mount(req.spec);
     if (req.op === "umount") return l.umount(req.target);
     if (req.op === "insert") return l.insert(req.target, req.handle, req.source);
-    return l.mounts.list();
+    return l.mounts.listed();
   }
   const attestOp = attestOps(port);
   async function handle(req) {