On Linux and macOS, sceKernelRaiseException runs the guest handler in
the target's SIGUSR1 handler wherever the thread was interrupted. A
thread interrupted while it held the address-wait lock of
sceKernelSyncOnAddressWait, sceKernelSyncOnAddressWake or _umtx_op ran
the handler with the lock held, so a handler that waits, as a
stop-the-world collector's does, blocked every other thread that waits
on or wakes an address. #5756 fixed this on Windows.
The address-wait lock is now taken under DeliveryDeferral on every
host. On POSIX the deferral is a count per thread: while it is raised
the SIGUSR1 handler only records the signal, and DeliverDeferred sends
it to the thread again once the lock is released. An address waiter
waits on its own semaphore (sem_t, a dispatch semaphore on macOS) with
the lock released and the deferral lifted, so a raise reaches a thread
that waits for an address without a timeout.
The address-lock phases of guest_raise_exception now run on every
host, with a new phase that raises at a thread in an unbounded address
wait.
sceKernelGetSystemExVersion, sysKernelGetLowerLimitSysexVersion,
sysKernelGetLowerLimitUpdVersion and sceKernelGetTraceMemoryStats were
NotImplemented stubs in libkernel_sys. libkernel, libkernel_sys and
libkernel_web of firmware 13.42 answer them without asking the kernel:
empty strings, a zero version and zero statistics, with the null checks
and return codes the firmware uses, including the plain 22 of
sceKernelGetSystemExVersion.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
RaiseOn suspends the target, reads its context and, while it is in host
code, resumes it and samples again after SwitchToThread. On a 16-core
Ryzen 9 5950X (Windows 11 22H2) that resampled the writer of
guest_raise_in_host_code about every 10 us before it could run: in the
raise that hung, 4,989 samples over 50 ms all found it in ucrtbase, so
the 50 ms host-code limit ran out and the handler was redirected into
fwrite, where it deadlocked on the stream lock (the test timed out at
30 s on every run). In a passing raise the samples sat at one RIP for
14,695 of 14,703 samples and the raise took 145 ms.
Spin for 20 us before each new host-code sample, so the target gets to
leave host code. With that, guest_raise_in_host_code passes 5 of 5 runs,
no raise is redirected in host code, and the longest raise is 0.46 to
0.53 ms. Other samples keep SwitchToThread.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD 11.4 serves kern.boottime ({CTL_KERN, KERN_BOOTTIME}) from
sysctl_kern_boottime in sys/kern/kern_tc.c as a read-only 16-byte struct
timeval, so a size query reports 16, a short buffer gets a partial copy
and ENOMEM, and a write gets EPERM from sysctl_root. sysctl, sysctlbyname
and sysctlnametomib now answer it with the guest CLOCK_REALTIME minus
CLOCK_UPTIME, taken at the first read and kept. HotSpot reads it while
writing its error report, which aborted with "unsupported MIB 1.21".
PS5VR (PPSA99177) reads sysctl {CTL_KERN, KERN_PROC, KERN_PROC_ENV, pid}
for its own pid at start-up and stopped on "unsupported MIB 1.14.35.<pid>".
The call now returns the empty start-up environment that environ and
libc's getenv also begin with, and follows FreeBSD 11's
sysctl_kern_proc_env for the errors: EINVAL for a MIB without exactly one
pid, ESRCH for another pid or -1, EPERM for a write.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Follow FreeBSD 11.4 sys_setresuid and sys_setresgid (sys/kern/kern_prot.c):
accept real, effective, and saved user and group IDs for the guest process,
which is assumed to run as root with IDs 0. Setting an ID to 0 or -1 (unchanged)
is accepted without changing credentials and returns 0; any other value throws.
Cover both in guest_credentials test and update libkernel debt documentation.
The PS5 libkernel exports _accept, _bind, _connect, _getdirentries,
_getpeername, _getsockname, _getsockopt, _listen, _recvfrom, _recvmsg,
_sendmsg, _sendto, _setsockopt, _sigaction and _sigsuspend (PS5 3.20
export list, DNNDHH/PS5-3.20_Libs b2a77c0 libkernel.c), and main
exports none of them, so a title importing one fails at startup. Each
now forwards to the export without the underscore, as _close, _ioctl
and _nanosleep already do.
In FreeBSD 11.4 (8c639945a4) these are libc's plain system call
entries: lib/libc/amd64/SYS.h makes bind, getdirentries, getpeername,
getsockname, getsockopt, listen and setsockopt one stub under both
names, and lib/libc/sys/Makefile.inc gives accept, connect, recvfrom,
recvmsg, sendmsg, sendto, sigaction and sigsuspend a separate public
name that goes through libthr's interposing table, which adds the
cancellation points and the sigaction wrapper. The exports without the
underscore have no libthr layer here, so forwarding gives the system
call. docs/dev/debt/libkernel.md records what stays unverified: the
console is not measured, _sigaction shares the handler table of
sigaction, and a null set throws in _sigsuspend as in sigsuspend,
where FreeBSD's system call returns EFAULT.
guest_underscore_entries calls every new export: a loopback TCP
connection, UDP datagrams with scatter, truncation and sender
addresses, a directory listing compared with getdirentries, a SIGTERM
handler set by _sigaction, and a pending SIGUSR1 that _sigsuspend
delivers before returning EINTR with the mask restored. It checks the
errors they pass on (EBADF, EINVAL, EFAULT, ENOPROTOOPT, EOPNOTSUPP)
and that outputs stay untouched on failure.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD 11's kern_sigaction (sys/kern/kern_sig.c) calls
sigqueue_delete_proc, which drops the signal from the process queue and
from every thread's queue, whenever the new handler is SIG_IGN, or
SIG_DFL on a signal whose sigprop has SA_IGNORE (SIGURG, SIGCONT,
SIGCHLD, SIGIO, SIGWINCH, SIGINFO). It does so whether or not the
signal is blocked. sigaction and signal now take the signal off the
pending set in those cases, so a later unblock or wait never sees it.
The call threw for lack of a signature. In the PS5 12.00 libkernel it takes
one int, passes it to syscall 601 (command 29) and returns the raw kernel
result. No dump is produced here, so it returns 0, as
sceCoredumpConfigDumpMode does.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
Follow FreeBSD 11.4 sys_getresuid and sys_getresgid (sys/kern/kern_prot.c):
retrieve real, effective, and saved user and group IDs for the guest process,
which is assumed to run as root with IDs 0. Pointers that are not null receive 0,
null pointers are ignored, and 0 is returned leaving errno unchanged on success.
Cover both in guest_credentials test and update libkernel debt documentation.
The public SDK's libkernel, libkernel_sys and libkernel_web stub tables declare _sigintr, the
sigset_t that FreeBSD's libc shares between signal and siginterrupt, and no built library
provided it (#8846). libkernel now exports the 16-byte object, zero at start, and signal records
a handler with SA_RESTART unless its signal is in the set, as lib/libc/gen/signal.c does.
siginterrupt, which fills the set, is a libSceLibcInternal export; libc does not link libkernel
and cannot reach the dispositions, so it stays out and a debt entry for signal says so.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
pthread_kill(thread, 0) returned 0 for every handle other than the caller's before it asked whether the thread was still alive. FreeBSD's _pthread_kill looks the thread up with _thr_find_thread before it checks for signal 0, so the call answers ESRCH for a thread that has ended or was never a thread. The liveness check now runs before the signal 0 shortcut; the calling thread still answers 0.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Since #8512 a raise redirects a target running host code once 50 ms have
passed since the raise began. A target inside a system call that is not a
wait, such as the NtWriteFile of an fwrite that holds its stream lock, can
stay there longer; the redirect then ran the handler with the lock held.
SONIC SUPERSTARS froze at frame 67 again on main this way, with its GC
raise delivered at ntdll!ZwWriteFile+20.
A target stopped right after a syscall instruction in ntdll now restarts
the 50 ms host-code window, so the raise keeps sampling until the call
returns and the target leaves host code, bounded by the 1 s retry limit.
guest_raise_in_system_call holds a writer in NtWriteFile on a slowly
drained pipe; it times out on main and passes with this change.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
GetThreadContext can fail on a target that was just suspended. A raise
used to throw "cannot read the target thread context" at the first
failure; it now resumes the target and tries again, within the existing
1 s retry limit, before throwing. SONIC SUPERSTARS hit the throw once in
three runs. guest_raise_in_host_code prints the longest single raise.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Retr0