The staging buffer was sized by the guest's nevents, so a request for
INT_MAX events allocated about 64 GiB before the queue reported how many
were pending. It's now bounded at 1024 events; kevent may return fewer
than requested, and events left in the queue come back on the next call.
The test covers an INT_MAX request and a 1030-event queue, and moves away
from the end of StandardInput and the start of main, where #9575 and
#10014 also add tests.
ioctl(FIONBIO) read its int argument directly after the existing null
check, so a non-null pointer into unmapped memory crashed the host.
FIONBIO is an _IOW request, which FreeBSD copies in and fails with
EFAULT; the argument is now copied in with GuestCopyIn_nid_no_patch
before the status change.
setrlimit read the guest rlimit struct directly, so a non-null pointer
into unmapped memory crashed the host. It now copies the struct in with
GuestCopyIn_nid_no_patch together with the existing null check, before
the resource check, as FreeBSD's sys_setrlimit copies in before
kern_setrlimit validates the resource, and fails with EFAULT.
Titles that execute rdtsc themselves ignored APS5_TIME_SCALE, because
only sceKernelReadTsc scaled its ticks. The reported TSC frequency is
now divided by the scale and sceKernelReadTsc returns raw ticks, so
ticks over the reported frequency follow the scale for both. The
JobManager worker spin keeps real time through the host frequency.
AI-assisted: yes
pselect read its timeout directly, passed the guest signal mask straight
to SetSignalMaskCatching_nid_no_patch, which dereferences it, and saved
and restored the descriptor sets with memcpy after a caught signal, so a
non-null pointer into unmapped or read-only memory crashed the host. It
now copies the timeout and the mask in with GuestCopyIn_nid_no_patch,
as FreeBSD's sys_pselect does before changing the mask, and saves and
restores the sets with GuestCopyIn_nid_no_patch and
GuestCopyOut_nid_no_patch, failing with EFAULT. A bad timeout or mask
leaves the thread's signal mask unchanged.
With -DBUILD_TESTING=ON -DANYPS5_RELINKER_CLI=OFF the generate step
failed: exec_arguments, loadexec_arguments, guest_timed_join_import_*,
guest_runtime_lifecycle and agc_driver_guest_memory_lifetime_converted
name the relinker target, which core/relinker defines only when the
option is on. The option is now declared in the root CMakeLists.txt,
before core/libs, and those tests are registered only with the command
line, as core/relinker already does for its own command line tests.
kevent read the changelist and the timeout and wrote the eventlist in
place, so a non-null pointer into unmapped or read-only memory crashed
the host. It now copies the timeout in first, as FreeBSD's sys_kevent
does, copies each change in with GuestCopyIn_nid_no_patch and copies
EV_ERROR entries out one at a time. Triggered events are collected by
the same single queue call as before into a host buffer (on the stack
up to 64 events) and copied out with GuestCopyOut_nid_no_patch, so
level-triggered events are still reported once per call. Any failed
copy returns EFAULT.
Keep a copy of the name with the semaphore and move the export from the libkernel_sys stub into libkernel next to the other sem_* exports.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
A cleared kqueue watch read the watched queue's triggered count and its
activation counter under two separate locks, so an activation between the
reads was marked seen without making the watch active, and the wakeup was
lost. SnapshotTriggered now returns both under one lock. Every poll of an
active watch also rechecks the count, as kqueue_scan reruns filt_kqueue:
it drops when the watched queue empties and reports the current count.
EV_ADD and EV_ENABLE of an existing watch re-arm it. A separate
guest_kqueue_cleared_race test triggers the watched queue from another
thread while the watching queue waits.
FreeBSD re-evaluates a kqueue's EVFILT_READ note from kqueue_wakeup,
which runs whenever the watched kqueue queues a note, so an EV_CLEAR
note fires again only after such an activation. The equeue now counts
activations, and the EV_CLEAR note fires when the count moves while
notes are queued.
On Windows, std::filesystem::symlink_status and is_symlink report a directory symbolic link as a plain directory, so rmdir removed the link instead of failing with ENOTDIR (20) and unlink failed with EPERM (1) instead of removing it, unlike FreeBSD. Detect the symlink reparse tag with FindFirstFileW: rmdir returns ENOTDIR, unlink removes the link with RemoveDirectoryW. Junctions and volume mounts keep their previous behaviour. Enable the directory-link and dangling-link blocks of guest_filesystem on Windows (created with CreateSymbolicLinkW).
AI-assisted: yes
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GtXavMkgCTCdmRpweviHcQ
poll read and wrote the guest pollfd array in place, so a non-null array
in unmapped or read-only memory crashed the host. It now copies the
array in with GuestCopyIn_nid_no_patch, polls the local copy and copies
the results back with GuestCopyOut_nid_no_patch, failing with EFAULT
like FreeBSD's copyin and copyout. Timeout validation still comes
first, and a failed poll copies nothing back.
The PS5 3.20 export lists have ksem_* in libkernel as well as
libkernel_sys, and on Windows a libkernel import never reaches
libkernel_sys, so titles importing them from libkernel did not find
them. Following pipe1os's review on #9284, also: ENOSPC from
ksem_init when no descriptor is left, the SEM_MAX limit of 30 with
ENOSPC, and dup/dup2 from a ksem id throwing as for a kqueue.
Adrià