PS5_PayloadSDK measured in a title (firmware 12.09) that
pthread_getaffinity_np answers sets of 8 and 16 bytes and returns ERANGE
for 32 bytes or more, so FreeBSD's 32-byte cpuset_t is refused. The call
accepted exactly 32 bytes and refused every other size. Sizes under 8
keep ERANGE; 17 to 31 bytes, between the measured sizes, throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD's sys_rtprio_thread returns ESRCH for an unknown lwpid before a
failed copyin of the struct, so the copy-in now follows the thread
lookup, and RTP_SET with an unknown lwpid and an unreadable struct
reports ESRCH. Tests pin that order and sched_rr_get_interval's pid check
before its copy-out.
rtprio_thread read and wrote the guest rtprio struct in place, and
sched_rr_get_interval wrote the interval in place, so a non-null pointer
into unmapped or read-only memory crashed the host. rtprio_thread now
copies the struct in with GuestCopyIn_nid_no_patch before the thread
lookup for RTP_SET, as FreeBSD's sys_rtprio_thread does, and builds the
RTP_LOOKUP result locally and copies it out with
GuestCopyOut_nid_no_patch. sched_rr_get_interval copies its interval out
the same way. A failed copy returns EFAULT.
Keep a copy of the name with the semaphore and move the export from the libkernel_sys stub into libkernel next to the other sem_* exports.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Under Rosetta the main thread stack lies at about 12 GiB, inside the guest
arena, where a title can map fixed addresses; a fixed mapping over it
aborts with a host region overlap.
- Aps5StartGuest moves the main thread onto a 16 MiB stack at
0x600000000000 when the old stack overlaps a host region of the arena.
It copies argv, environ, the program name and the initial block off the
old stack, then frees the old stack and releases its range to the arena.
- The guest thread keeps the stack size of the original main thread.
- The arena gets GuestArenaOverlapsHostRegion and
GuestArenaReleaseHostRegion for POSIX hosts.
- guest_main_stack_move starts the guest, then requires the main thread
outside the arena, a fixed mapping where the old stack was, and argv and
the environment intact.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
scePthreadMutexattrSetkind called NotImplemented_nid_no_patch for a kind
outside 1 to 4. Firmware 13.42's libkernel, run in an emulator, makes it
call pthread_mutexattr_setkind_np, which stores any kind as a signed
16-bit value and returns 0, and turns a null attribute's -1 with errno 22
into 0x8001FFFF. It now forwards to pthread_mutexattr_setkind_np and
converts the result with sceKernelError, so a null attribute or object
still returns 0x8001FFFF and now also sets errno 22.
An out-of-range kind is refused by scePthreadMutexInit with 0x80020016,
leaving the mutex untouched, as measured for the same module.
scePthreadMutexattrGetkind is unchanged; kind 0 now reaches it and
returns 0.
FreeBSD code reaches its thread pointer through %fs and macOS cannot set
the fs base. The macOS relinker turns each %fs access of a guest image
into a stub that reads the thread pointer from a pthread key and calls
Aps5GuestTlsAllocate on a thread's first access, registers the TLS
descriptor of an image with Aps5GuestTlsRegister, and routes
__tls_get_addr to Aps5GuestTlsGetAddr. No library provided them, so a
relinked executable could not start.
- Aps5GuestTlsRegister validates the descriptor the relinker wrote and
creates the key; its destructor frees the block of a thread.
- Aps5GuestTlsAllocateThreadPointer allocates the block (the TLS template
followed by zeros, then a 0x100-byte thread control block whose first
word points at itself, as on FreeBSD) and stores the thread pointer
under the key.
- Aps5GuestTlsAllocate is the entry the stubs call: rax holds the
descriptor and returns the thread pointer, every other register is
preserved, the upper halves of the ymm registers only where AVX exists.
- Aps5GuestTlsGetAddr returns the block of the thread plus the offset.
Co-authored-by: mugurc <[email protected]>
pthread_condattr_getclock threw for a null attribute pointer or a null
handle. FreeBSD 11.4 libthr (lib/libthr/thread/thr_condattr.c) returns
EINVAL for both before reading the clock, as setclock, setpshared,
getpshared and destroy here already do. A null output pointer with a
valid attribute faults on FreeBSD, so it still throws.
scePthreadCondInit ignores its name and nothing reads a condition variable name back, so pthread_cond_setname_np now only validates the condition variable and the name. Drops the stale libkernel_sys declaration and moves the debt entry to Silent stubs, citing shadPS4.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Adrià