FreeBSD's sys_rtprio_thread returns ESRCH for an unknown lwpid before a
failed copyin of the struct, so the copy-in now follows the thread
lookup, and RTP_SET with an unknown lwpid and an unreadable struct
reports ESRCH. Tests pin that order and sched_rr_get_interval's pid check
before its copy-out.
rtprio_thread read and wrote the guest rtprio struct in place, and
sched_rr_get_interval wrote the interval in place, so a non-null pointer
into unmapped or read-only memory crashed the host. rtprio_thread now
copies the struct in with GuestCopyIn_nid_no_patch before the thread
lookup for RTP_SET, as FreeBSD's sys_rtprio_thread does, and builds the
RTP_LOOKUP result locally and copies it out with
GuestCopyOut_nid_no_patch. sched_rr_get_interval copies its interval out
the same way. A failed copy returns EFAULT.
RTP_LOOKUP threw for every thread made with the sce attributes, which
allow only SCHED_FIFO and SCHED_RR, since the rtprio mapping was
unmeasured. In a payload process on a PS5 (firmware 12.70) the lookup
reports type 10 for SCHED_FIFO and 2 for SCHED_RR with prio equal to the
scheduling priority, for the calling thread and for another live thread
by its id; an unknown id fails with ESRCH, and so did function 2. Report
that, and keep RTP_SET throwing for real-time and other threads, where no
accepted value was measured.
babyhuey