The patched libkernel does not hand its plain C++ functions to the other patched libraries: every cross-library call in the tree goes through an extern C helper with a _nid suffix. The host CPU probe had none, so a library that wants the CPU model or the missing feature list cannot reach it. These helpers return plain structs, as the application metadata helpers do.
On Windows, mmap sent a shared memory descriptor straight to the shared
file mapper, skipping the checks and the private path that a regular
file descriptor takes. A private mapping of a named or anonymous object
then failed with EOPNOTSUPP, and a writable shared mapping of a
read-only descriptor failed with EIO instead of EACCES. Shared memory
objects are files on Windows, so they now take the same access checks
and the same private copy as a regular file; only the directory, device
and file-type refusals stay limited to other descriptors.
guest_named_shm_windows_mapping covers shared mappings through two
descriptors, pread and pwrite against them, an offset mapping, a private
mapping, read-only mappings and the mappings after shm_unlink.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PS5_PayloadSDK measured in a title (firmware 12.09) that
pthread_getaffinity_np answers sets of 8 and 16 bytes and returns ERANGE
for 32 bytes or more, so FreeBSD's 32-byte cpuset_t is refused. The call
accepted exactly 32 bytes and refused every other size. Sizes under 8
keep ERANGE; 17 to 31 bytes, between the measured sizes, throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Return the main program's handle, the first one sceKernelGetModuleList
lists and one sceKernelGetModuleInfo accepts. reSOT (PPSA99023) imports
it from libkernel and passes the handle to sceKernelGetModuleInfo to find
its own code segment; before this its eboot failed to load on the
unresolved import.
The PS5 3.20 export lists have it in libkernel as well as libkernel_sys,
and on Windows a libkernel import never reaches libkernel_sys, so the
throwing libkernel_sys stub moves to libkernel as pselect did.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The staging buffer was sized by the guest's nevents, so a request for
INT_MAX events allocated about 64 GiB before the queue reported how many
were pending. It's now bounded at 1024 events; kevent may return fewer
than requested, and events left in the queue come back on the next call.
The test covers an INT_MAX request and a 1030-event queue, and moves away
from the end of StandardInput and the start of main, where #9575 and
#10014 also add tests.
FreeBSD's sys_rtprio_thread returns ESRCH for an unknown lwpid before a
failed copyin of the struct, so the copy-in now follows the thread
lookup, and RTP_SET with an unknown lwpid and an unreadable struct
reports ESRCH. Tests pin that order and sched_rr_get_interval's pid check
before its copy-out.
GuestLoadAverage's braced initializer left its four bytes of padding after ldavg indeterminate, and the sysctl copies all 24 bytes to the guest. The scaled value of a load over UINT32_MAX / 2048 was converted out of range. The test now checks the padding and the exact fscale 2048 scaling against the host averages read just before and after the call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
ioctl(FIONBIO) read its int argument directly after the existing null
check, so a non-null pointer into unmapped memory crashed the host.
FIONBIO is an _IOW request, which FreeBSD copies in and fails with
EFAULT; the argument is now copied in with GuestCopyIn_nid_no_patch
before the status change.
setrlimit read the guest rlimit struct directly, so a non-null pointer
into unmapped memory crashed the host. It now copies the struct in with
GuestCopyIn_nid_no_patch together with the existing null check, before
the resource check, as FreeBSD's sys_setrlimit copies in before
kern_setrlimit validates the resource, and fails with EFAULT.
rtprio_thread read and wrote the guest rtprio struct in place, and
sched_rr_get_interval wrote the interval in place, so a non-null pointer
into unmapped or read-only memory crashed the host. rtprio_thread now
copies the struct in with GuestCopyIn_nid_no_patch before the thread
lookup for RTP_SET, as FreeBSD's sys_rtprio_thread does, and builds the
RTP_LOOKUP result locally and copies it out with
GuestCopyOut_nid_no_patch. sched_rr_get_interval copies its interval out
the same way. A failed copy returns EFAULT.
Adrià