FreeBSD 11.4's sys___sysctl and userland_sysctl copy the name and the
old length in, and copy the value and the length out, so a bad pointer
gives EFAULT in that order. sysctl dereferenced them directly, and
sysctlbyname read its name with strcmp.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The debt entry on pointer fixups in executable segments claimed that
dyld refuses them, which no run had shown. It now states what was
measured on an M1 Pro running macOS 27.0.1 under Rosetta 2: dyld_info
reports both cases, the PF_R|PF_W|PF_X case loads and runs, and a
fixup into a PF_R|PF_X segment ends with SIGBUS in dyld. The
interpreter_in_code fixture keeps a read-only data PT_LOAD for the
Windows runs, so PE output still covers a RELATIVE into it.
The macOS image writer emitted dyld rebase and bind opcodes for any
target inside a segment, so an R_X86_64_RELATIVE into an R-X PT_LOAD
became a rebase into a read-execute segment. dyld-1378 refuses fixups
in segments without write access (enforceFixupsInWritableSegments), so
Locate now throws when the target segment lacks VM_PROT_WRITE. Such
inputs now fail the macOS conversion instead of writing an output that
dyld would not load.
- mlock on macOS skipped every page the locked ranges recorded, but a
mapping that replaces a locked range in place leaves the record behind
without wires, so a later mlock returned 0 and wired nothing. Within a
recorded range it now wires again the host regions whose wire count is
0. The mlock test locks, remaps the range fixed and locks again.
- munlock and munlockall on macOS hold the locked-range lock across the
host unwire and the record update, so a concurrent mlock cannot see a
range as wired while it is being unwired.
- sceKernelVirtualQuery limits the host region it reports to the write
watch run that holds the address, so the permissions it reports hold
for the whole extent.
- The libc debt entry says what the mapping paths do: they register the
range again, and GuestWriteWatchProtectionChanged has no caller yet.
- mlock on macOS wires only the pages libkernel has not wired yet. XNU
counts each wire of a page, and the locked ranges merge overlapping
locks, so a page locked twice stayed wired after munlock and
munlockall. The mlock test checks the wire count on macOS.
- mprotect changes a watched page through GuestWriteWatchProtect, which
applies the host protection and records it under the write watch's
lock, so a collection on another thread cannot run between the two.
The write watch test covers it.
- sceKernelVirtualQuery takes a watched page's write permission from the
write watch for memory outside the guest allocation registry.
- GuestAllocationsGuestPages counts an image segment up to the end of
its last host page, as the image page collection does.
- The macOS includes stay in main's include block, so the host code
other pull requests add there still sees them; the unused Mach-O
headers and the end trim, which never changed the protected spans,
are gone, and the guest page size is passed in.
- The libc and libkernel debt entries describe what is wired now.
The previous commit ran the main stack checks on macOS through
_NSGetExecutablePath, but on macOS every child skips them: the stack is
mapped within 1 MiB of its bottom and its limit cannot be raised. They
are now built and run on Linux only, as in mugurc's macOS series, and
other hosts run the thread stack check alone.
The main stack checks run the test again in a child through
/proc/self/exe, which macOS does not have, so the child exited with 127
and the check failed before testing anything. On macOS the child now
runs the path _NSGetExecutablePath reports.
- mprotect: the guest rounds a range to its 16 KiB pages. A Mach-O image
is loaded at a multiple of the host page size only (4 KiB under
Rosetta), so the pages are counted from where the ELF address 0 of the
image holding the range was loaded, and a rounded edge smaller than a
guest page that lies in the gap between two segments, where no host page
exists, is left out. The write watch is told the new protection.
- sceKernelVirtualQuery reads the region with mach_vm_region.
- sceKernelMunlockall unlocks the ranges libkernel locked, one by one:
macOS has no munlockall, which fails there with ENOSYS and would
overwrite errno.
- The stack protect test reads page protections with mach_vm_region.
This is mugurc's f66a4df741 from his macOS series, without the mlock
check that #10889 adds.
Co-authored-by: mugurc <[email protected]>
Follow FreeBSD 11.4's sys_kldsym: EFAULT for an unreadable lookup
structure, EINVAL for a wrong version or command, EFAULT or
ENAMETOOLONG for the symbol name, ENOENT for a negative file id. Any
other lookup throws, as no kernel module is modelled. Adds
GuestCopyIn_nid_no_patch for the checked structure read.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The host sinh set errno to ERANGE on overflow and sinhf does, but the msun port
returned the overflowed value with errno untouched. The overflow path of
sinh_nid_postfix sets ERANGE again; msun itself sets no errno.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The table's Query type takes no arguments, which stopped converting once sceGnmRegisterOwner got its (void*, const char*) prototype. The call is checked on its own against Failure instead.
They still throw through NotImplemented_nid_no_patch; only the parameter
lists change. The only source is shadPS4's PS4 prototypes; nothing is measured on a PS5.
