openkal.exec —— 可写的映射,发布之后可执行 (#4)

* feat: openkal.exec —— 可写的映射,发布之后可执行

这个内核对两步都不设条件,所以这个实现无条件提供该接口 —— 不同于另一个系统,
在那里同一个接口只对以特定方式产出的制品可用,那是 6.5 覆盖的情形,不是这里的。

保留没有一上来就把映射设成可执行,尽管这个内核允许。目标环境里有两个拒绝
「既可写又可执行」的映射,所以在这里返回一块二者兼备的内存,等于给程序一个
它在别处用不了的形状 —— 而程序只会在那另一个系统上才发现。接口写的是更窄的
契约,这个实现照它来。

props 报 REPUBLISH:这个内核的保护调用不是单向的,调用方要改已发布的字节
不必丢弃整块区域。

验证:check-surface 对本实现报 56 个名字合规(此前 52,差的正是这四个);
conformance --features full 报 103 held / 0 did not hold,其中包括
「写进区域并发布的指令被执行了」。

依赖改为 git + 分支,已实测可解析:mcpp 克隆 feat/openkal-closure 后构建通过。

* ci: 声明测试的模块清单改为推导,不再写出来

它此前是写出来的,而规范第一次新增接口它就脱节了:SURFACE.txt 列了四个
kal_exec_* 名字,却没有发出 import openkal.exec,生成的测试报四个未声明的
标识符 —— 那名的是症状(有名字找不到),不是原因(这里有一份清单没跟上)。

SURFACE.txt 本来就把名字按 `# openkal.<接口>` 分组,它已经带着这份清单。
types 不是那里的一个组(它不声明任何 kal_ 名字),单独写。

本地按 CI 的步骤复现:推导出十行 import(含 exec),生成的测试 1 passed。

* feat: declare the kernel-abi layer this package supplies

mcpp resolves the target side per layer after the dependency graph is known,
and reads which layer a package fills from its capabilities. Declaring
`mcpp:kernel-abi=openkal` states that this package implements the platform
interface a C library sits on, and that it answers to the name `openkal`.

The engine knows the three layer names and none of the implementations that
fill them, so nothing about openkal appears in mcpp for this to work.

Claude-Session: https://claude.ai/code/session_01Q4ucduLuSsETHYJ1RkGVVD

* chore: 0.5.2

The manifest states a capability the previous release did not, and the index
serves published tarballs rather than branches. A consumer resolving through
the index would otherwise get content in which this package declares no layer,
and the engine would resolve its target side to the compiler payload.

Claude-Session: https://claude.ai/code/session_01Q4ucduLuSsETHYJ1RkGVVD

---------

Co-authored-by: speak-agent <x.d2learn.org@gmail.com>

Author: Sunrisepeak

.github/workflows/ci.yml

@@ -122,7 +122,21 @@ jobs:
           # fails to compile and the diagnostic names it.
           list="$(grep -vE '^[[:space:]]*(#|$)' .spec/SURFACE.txt | sort -u)"
           {
-            for m in types abort stream memory env time fs process task; do
+            # ⚠️ THE MODULE LIST IS DERIVED, NOT WRITTEN OUT.
+            #
+            # It used to be written out, and it fell out of step the first time
+            # the specification gained an interface: SURFACE.txt listed four
+            # `kal_exec_*' names, no `import openkal.exec' was emitted, and the
+            # generated test failed with four undeclared identifiers --- which
+            # names the symptom (a name is missing) and not the cause (a list
+            # here was not updated).
+            #
+            # SURFACE.txt groups its names under `# openkal.<interface>'
+            # headings, so the list it already carries is the list this needs.
+            # `types' is not a group there --- it declares no kal_ name --- and
+            # is therefore named separately.
+            echo "import openkal.types;"
+            for m in $(grep -oE '^# openkal\.[a-z]+' .spec/SURFACE.txt | cut -d. -f2); do
               echo "import openkal.$m;"
             done
             echo 'const void *const surface[] = {'

mcpp.toml

@@ -1,14 +1,24 @@
 [package]
 namespace   = "mcpplibs"
 name        = "openkal-linux"
-version     = "0.5.1"
+version     = "0.5.2"
 description = "The reference implementation of openkal for Linux, written on the kernel's own system-call interface so that it can be placed beneath a C library as well as above one."
 license     = "Apache-2.0"
+
+# The layer this package supplies, in the vocabulary the engine resolves.
+#
+# `mcpp:kernel-abi` names the platform interface a C library sits on. On a
+# traditional stack that seam is unnamed — a C library issues system calls or
+# calls the platform's own entry points directly — and naming it is what lets
+# one C library sit above several platforms. `=openkal` is the interface this
+# package answers to; several packages answer to it and the engine knows none
+# of them by name.
+provides    = ["mcpp:kernel-abi=openkal"]
 authors     = ["mcpplibs"]
 repo        = "https://github.com/mcpplibs/openkal-linux"
 
 [dependencies]
-openkal = "0.5.2"
+openkal = { git = "https://github.com/mcpplibs/openkal", branch = "feat/openkal-closure" }
 
 # The package contributes definitions and no modules. The interface it
 # implements is declared by the specification package, which this package

src/exec.cpp

@@ -0,0 +1,61 @@
+#include "sys.h"
+#include <openkal/exec.h>
+
+// openkal.exec on this kernel.
+//
+// A mapping obtained writable and made executable afterwards. The kernel places
+// no condition upon either step, so this implementation provides the interface
+// unconditionally --- unlike one of the other systems, where the same interface
+// is available only to a program produced in a particular way, which clause 6.5
+// covers and which is not this system's case.
+//
+// The reservation is not made executable at the outset even though this kernel
+// would permit it. Two of the three environments the specification targets
+// refuse a mapping that is both, so an implementation that returned one here
+// would be offering a program a shape it could not use elsewhere --- and the
+// program would discover that only on the other system. The interface states
+// the narrower contract and this implementation keeps to it.
+
+namespace {
+
+constexpr okl_uptr kPage = 4096;
+
+okl_uptr round_up(okl_uptr n, okl_uptr to) { return (n + to - 1) & ~(to - 1); }
+
+}  // namespace
+
+extern "C" {
+
+void* kal_exec_alloc(kal_uintptr size) {
+    if (size == 0) return nullptr;
+    const okl_uptr bytes = round_up(static_cast<okl_uptr>(size), kPage);
+    const okl_long r = okl::sys(okl::nr_mmap, 0, static_cast<okl_long>(bytes),
+                                okl::prot_read | okl::prot_write,
+                                okl::map_private | okl::map_anonymous, -1, 0);
+    if (okl::failed(r)) return nullptr;
+    return reinterpret_cast<void*>(r);
+}
+
+int kal_exec_publish(void* p, kal_uintptr size) {
+    if (p == nullptr || size == 0) return kal_err_invalid;
+    const okl_uptr bytes = round_up(static_cast<okl_uptr>(size), kPage);
+    const okl_long r = okl::sys(okl::nr_mprotect, reinterpret_cast<okl_long>(p),
+                                static_cast<okl_long>(bytes),
+                                okl::prot_read | okl::prot_exec);
+    if (okl::failed(r)) return okl::translate(r);
+    return kal_ok;
+}
+
+void kal_exec_free(void* p, kal_uintptr size) {
+    if (p == nullptr || size == 0) return;
+    const okl_uptr bytes = round_up(static_cast<okl_uptr>(size), kPage);
+    okl::sys(okl::nr_munmap, reinterpret_cast<okl_long>(p),
+             static_cast<okl_long>(bytes));
+}
+
+// A published region may be reserved for writing again: this kernel's
+// protection call is not one-way. The position is set accordingly, and a
+// caller that must change published bytes need not abandon the region.
+const kal_uintptr kal_exec_props = KAL_EXEC_PROP_REPUBLISH;
+
+}  // extern "C"

src/sys.h

@@ -197,7 +197,7 @@ enum : okl_long {
     o_creat = 0100, o_excl = 0200, o_trunc = 01000, o_append = 02000,
     o_directory = 0200000, o_cloexec = 02000000, o_nofollow = 0400000,
     at_fdcwd = -100, at_removedir = 0x200, at_symlink_nofollow = 0x100,
-    prot_read = 1, prot_write = 2, prot_none = 0,
+    prot_read = 1, prot_write = 2, prot_exec = 4, prot_none = 0,
     map_private = 2, map_anonymous = 0x20, map_stack = 0x20000,
     clock_monotonic = 1, clock_realtime = 0,
     futex_wait = 0, futex_wake = 1, futex_private = 128,