ioctl(FIONBIO) read its int argument directly after the existing null
check, so a non-null pointer into unmapped memory crashed the host.
FIONBIO is an _IOW request, which FreeBSD copies in and fails with
EFAULT; the argument is now copied in with GuestCopyIn_nid_no_patch
before the status change.
pselect read its timeout directly, passed the guest signal mask straight
to SetSignalMaskCatching_nid_no_patch, which dereferences it, and saved
and restored the descriptor sets with memcpy after a caught signal, so a
non-null pointer into unmapped or read-only memory crashed the host. It
now copies the timeout and the mask in with GuestCopyIn_nid_no_patch,
as FreeBSD's sys_pselect does before changing the mask, and saves and
restores the sets with GuestCopyIn_nid_no_patch and
GuestCopyOut_nid_no_patch, failing with EFAULT. A bad timeout or mask
leaves the thread's signal mask unchanged.
Keep a copy of the name with the semaphore and move the export from the libkernel_sys stub into libkernel next to the other sem_* exports.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
A cleared kqueue watch read the watched queue's triggered count and its
activation counter under two separate locks, so an activation between the
reads was marked seen without making the watch active, and the wakeup was
lost. SnapshotTriggered now returns both under one lock. Every poll of an
active watch also rechecks the count, as kqueue_scan reruns filt_kqueue:
it drops when the watched queue empties and reports the current count.
EV_ADD and EV_ENABLE of an existing watch re-arm it. A separate
guest_kqueue_cleared_race test triggers the watched queue from another
thread while the watching queue waits.
FreeBSD re-evaluates a kqueue's EVFILT_READ note from kqueue_wakeup,
which runs whenever the watched kqueue queues a note, so an EV_CLEAR
note fires again only after such an activation. The equeue now counts
activations, and the EV_CLEAR note fires when the count moves while
notes are queued.
On Windows, std::filesystem::symlink_status and is_symlink report a directory symbolic link as a plain directory, so rmdir removed the link instead of failing with ENOTDIR (20) and unlink failed with EPERM (1) instead of removing it, unlike FreeBSD. Detect the symlink reparse tag with FindFirstFileW: rmdir returns ENOTDIR, unlink removes the link with RemoveDirectoryW. Junctions and volume mounts keep their previous behaviour. Enable the directory-link and dangling-link blocks of guest_filesystem on Windows (created with CreateSymbolicLinkW).
AI-assisted: yes
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GtXavMkgCTCdmRpweviHcQ
poll read and wrote the guest pollfd array in place, so a non-null array
in unmapped or read-only memory crashed the host. It now copies the
array in with GuestCopyIn_nid_no_patch, polls the local copy and copies
the results back with GuestCopyOut_nid_no_patch, failing with EFAULT
like FreeBSD's copyin and copyout. Timeout validation still comes
first, and a failed poll copies nothing back.
The PS5 3.20 export lists have ksem_* in libkernel as well as
libkernel_sys, and on Windows a libkernel import never reaches
libkernel_sys, so titles importing them from libkernel did not find
them. Following pipe1os's review on #9284, also: ENOSPC from
ksem_init when no descriptor is left, the SEM_MAX limit of 30 with
ENOSPC, and dup/dup2 from a ksem id throwing as for a kqueue.
A guest mmap with PROT_EXEC and MAP_SHARED of a shared-memory object or a regular file threw on Windows. The section is now created from a handle reopened with GENERIC_EXECUTE, as PAGE_EXECUTE_READ or PAGE_EXECUTE_READWRITE, the owner ACE of named objects grants execute with read, and a writable shared mapping of a read-only descriptor fails with EACCES, as FreeBSD 11.4 shm_mmap and vn_mmap do.
Fixes#12337
sceKernelRmdir decided whether the last component was a symbolic link with
std::filesystem::is_symlink, which follows the link with WinLibs libstdc++ on
Windows. A dangling or self-referencing file link then looked missing on
Windows 10 (ENOENT instead of ENOTDIR), and a directory link to an empty
directory looked like that directory, so rmdir removed the link and
returned 0. The last component is now classified with FillLinkStat, the
same lstat path lstat_nid_postfix uses, matching FreeBSD 11 kern_rmdirat,
which returns ENOTDIR for any non-directory vnode found without following
the last link.
Fixes#12079
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Adrià