ioctl(FIONBIO) read its int argument directly after the existing null
check, so a non-null pointer into unmapped memory crashed the host.
FIONBIO is an _IOW request, which FreeBSD copies in and fails with
EFAULT; the argument is now copied in with GuestCopyIn_nid_no_patch
before the status change.
setrlimit read the guest rlimit struct directly, so a non-null pointer
into unmapped memory crashed the host. It now copies the struct in with
GuestCopyIn_nid_no_patch together with the existing null check, before
the resource check, as FreeBSD's sys_setrlimit copies in before
kern_setrlimit validates the resource, and fails with EFAULT.
Titles that execute rdtsc themselves ignored APS5_TIME_SCALE, because
only sceKernelReadTsc scaled its ticks. The reported TSC frequency is
now divided by the scale and sceKernelReadTsc returns raw ticks, so
ticks over the reported frequency follow the scale for both. The
JobManager worker spin keeps real time through the host frequency.
AI-assisted: yes
pselect read its timeout directly, passed the guest signal mask straight
to SetSignalMaskCatching_nid_no_patch, which dereferences it, and saved
and restored the descriptor sets with memcpy after a caught signal, so a
non-null pointer into unmapped or read-only memory crashed the host. It
now copies the timeout and the mask in with GuestCopyIn_nid_no_patch,
as FreeBSD's sys_pselect does before changing the mask, and saves and
restores the sets with GuestCopyIn_nid_no_patch and
GuestCopyOut_nid_no_patch, failing with EFAULT. A bad timeout or mask
leaves the thread's signal mask unchanged.
Keep a copy of the name with the semaphore and move the export from the libkernel_sys stub into libkernel next to the other sem_* exports.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
A cleared kqueue watch read the watched queue's triggered count and its
activation counter under two separate locks, so an activation between the
reads was marked seen without making the watch active, and the wakeup was
lost. SnapshotTriggered now returns both under one lock. Every poll of an
active watch also rechecks the count, as kqueue_scan reruns filt_kqueue:
it drops when the watched queue empties and reports the current count.
EV_ADD and EV_ENABLE of an existing watch re-arm it. A separate
guest_kqueue_cleared_race test triggers the watched queue from another
thread while the watching queue waits.
FreeBSD re-evaluates a kqueue's EVFILT_READ note from kqueue_wakeup,
which runs whenever the watched kqueue queues a note, so an EV_CLEAR
note fires again only after such an activation. The equeue now counts
activations, and the EV_CLEAR note fires when the count moves while
notes are queued.
On Windows, std::filesystem::symlink_status and is_symlink report a directory symbolic link as a plain directory, so rmdir removed the link instead of failing with ENOTDIR (20) and unlink failed with EPERM (1) instead of removing it, unlike FreeBSD. Detect the symlink reparse tag with FindFirstFileW: rmdir returns ENOTDIR, unlink removes the link with RemoveDirectoryW. Junctions and volume mounts keep their previous behaviour. Enable the directory-link and dangling-link blocks of guest_filesystem on Windows (created with CreateSymbolicLinkW).
AI-assisted: yes
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GtXavMkgCTCdmRpweviHcQ
poll read and wrote the guest pollfd array in place, so a non-null array
in unmapped or read-only memory crashed the host. It now copies the
array in with GuestCopyIn_nid_no_patch, polls the local copy and copies
the results back with GuestCopyOut_nid_no_patch, failing with EFAULT
like FreeBSD's copyin and copyout. Timeout validation still comes
first, and a failed poll copies nothing back.
The PS5 3.20 export lists have ksem_* in libkernel as well as
libkernel_sys, and on Windows a libkernel import never reaches
libkernel_sys, so titles importing them from libkernel did not find
them. Following pipe1os's review on #9284, also: ENOSPC from
ksem_init when no descriptor is left, the SEM_MAX limit of 30 with
ENOSPC, and dup/dup2 from a ksem id throwing as for a kqueue.
TakeSnapshot read FileBasicInfo and then FileStandardInfo. A truncate or
write landing between the two left a snapshot with the new size and the
old LastWriteTime, and the next poll reported the same size with a newer
LastWriteTime as NOTE_WRITE. guest_kqueue's FileWatch aborts on Windows
when that happens after its ftruncate to 0.
Read FileBasicInfo again after FileStandardInfo and retry until both
reads agree. The window NTFS itself leaves, a truncate's new
LastWriteTime shown before its new size, stays and is listed in the
libkernel debt.
A guest mmap with PROT_EXEC and MAP_SHARED of a shared-memory object or a regular file threw on Windows. The section is now created from a handle reopened with GENERIC_EXECUTE, as PAGE_EXECUTE_READ or PAGE_EXECUTE_READWRITE, the owner ACE of named objects grants execute with read, and a writable shared mapping of a read-only descriptor fails with EACCES, as FreeBSD 11.4 shm_mmap and vn_mmap do.
Fixes#12337
Adrià